# Clean-environment reproduction

Use a fresh machine or container that did not build the package. Any OS with Python 3.9 or newer works.

```sh
# 1. obtain (network on)
mkdir cain42-audit && cd cain42-audit
curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.3.2/cain42-auditor-kit-8.3.2.zip
curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.3.2/cain42-auditor-kit-8.3.2.zip.sha256
curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.3.2/cain42_verify.py
sha256sum -c cain42-auditor-kit-8.3.2.zip.sha256           # 2. hash
# 3. trust anchor: follow KEYS_AND_TRUST.md; record the channels you used
# 4. inspect without executing anything
python3 -c "import zipfile;[print(i.file_size,i.filename) for i in zipfile.ZipFile('cain42-auditor-kit-8.3.2.zip').infolist()]"
# 5. disconnect from the network, then run the initial verdict
python3 -I cain42_verify.py cain42-auditor-kit-8.3.2.zip --trust-anchor <ANCHOR> \
   --expect-sha256 $(cut -d' ' -f1 cain42-auditor-kit-8.3.2.zip.sha256) --expect-version 8.3.2 --out my_result.json
# 6. extract into a scratch directory and run the fixture suite (regenerates the fixtures and compares the hashes)
mkdir x && python3 -c "import zipfile;zipfile.ZipFile('cain42-auditor-kit-8.3.2.zip').extractall('x')"
cd x/cain42-auditor-kit-8.3.2 && python3 -I TESTS/run_fixture_suite.py --out ../../fixture_results.json && cd ../..
# 7. benchmark (30 runs)
python3 -I x/cain42-auditor-kit-8.3.2/BENCHMARKS/run_benchmark.py cain42-auditor-kit-8.3.2.zip --trust-anchor <ANCHOR> \
   --expect-sha256 <SHA> --runs 30 --out my_benchmark.json
```

Then compare your results with the files published next to the ZIP: `expected_verdict.json` and `benchmark-8.3.2.json`. Record every difference on `HUMAN_REVIEW/REPRODUCIBILITY_WORKSHEET.md`. Expected verdicts can change for legitimate reasons, for example `STALE_EVIDENCE` after the freshness window ends. Record why.