Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Constantly monitors your pictures folder without explicit permission”
Google Play · 1/5 · 2025-10-04

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2579644936

Proof data

Record hash (SHA-256): 1d322dc6ce8254ad52caafe98742cbdaffe7520e8c1e65ad93f06651396a6075
Signature (Ed25519, base64): BSlsWUCHznSyc4DSTkPUAwtLpSl3W5LxCy6G5cvKHQSSlU7ZxO7mp9KtNGFLuhp95CdOKW4H1U3LfVHGN7ikDQ==
Merkle root: c768716b2cb21aabc39de506951f775443418285e2c5eda072e3b3c2d945945c
Merkle path: ["1d31ac760d4107a2de6aef3f8b07d4356b424f7db6acf7eeb01fbbd7fde2fe64","f8ba8c1b9fbf4f088463e9af864a89332f0d3be74792457aa9f6bd40dd63619d","3f822f875e3f432b5d7ed303b3c421d535e3e9821758bdf90ca291fe3480846a","076d2172ddcd2f48bf120908d84a4a9c469cc05441e97a6396177eb1ecf86bb9","206892e79784ec9a1b0864aa6c6003faecd4953fe82e7e61d77125bc20867db5","0ca8bf0ac8bca386afbfa50169e9908a2f48cda51e29ee0850899a79e0242b65","feceb529872fa2d39a2a6e8783b65be028f5809424ee869db3a9be71a0c9d324","d798e36a417f61e551efbb40148a2629b644cbbeb845c398857ce0223ebb63f6","7d75c996f91260d1008cc1a76734e70b973c042cc528bc2678a95ab172d2a63e","c2ab37a567fd904c02c419e46f19d2f70e975819b637ac58ac2f8ae690a9c708","e78d5744cf872b19280090bfd39b1eba63c9898883268666185609ce5523ead3","920ed087a52e89a6ebb47019358ad236ea430da1db7ef2620e25ff0c3fdc3b6b","38e74f19a86a1311a4dbfb6ff75312ce32e1ae47f608a45fe54b6162c0fae8f4","58ccafd37278be2b9508db439c14e85a319c2716b397eaff7c959a5020ac606e","4c61c84fffc3f3248d19b221d821cc3f0e04d1cfb4151bcd103cb5959dfdd5ed"]
Anchored: 2026-08-24
Public log entry: search.sigstore.dev, log index 2579644936 · entry 108e9186e8c5677aee79…
Expected log hash: 3a9c8e6bb3b2990f2171448c5468a63b9d6f8bed98ee1b72cd7d6f73b4663243 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1787545182186","kind":"published-quote","locale":"en","page":"theme:acrobat/communication/en","quote":"Constantly monitors your pictures folder without explicit permission","rating":1,"review_date":"2025-10-04","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.adobe.reader","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c768716b2cb2…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.