Verify it yourself

1. Download the sample:

   for f in audit-sample-evidence.zip audit-sample-source.zip audit-code-check.py audit-kit-SHA256SUMS; do
     curl -sO https://cainstudio.online/$f; done
   sha256sum -c audit-kit-SHA256SUMS --ignore-missing
   mkdir src ev && (cd src && unzip -q ../audit-sample-source.zip) && (cd ev && unzip -q ../audit-sample-evidence.zip)
   pip install cryptography

2. Check the signature, with the key fetched from the site (better: confirm its fingerprint with us separately):

   KEY=$(curl -s https://cainstudio.online/keystone/public-key | python3 -c 'import json,sys;print(json.load(sys.stdin)["public_key_b64"])')
   (cd ev && python3 -I verify_keystone.py --pinned-pub "$KEY")      # ALL RECORDS VALID

3. Check the report is about this exact code:

   python3 -I audit-code-check.py audit-sample-evidence.zip src       # MATCH

4. Change anything (the report, a finding, one line of code) and run both again.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.