Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“faulty file selector”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2671768867

Proof data

Record hash (SHA-256)

04111cbaf2326d3e9385418d578ee87daa1ebd67e47dd7035ff0975286e0680f

Signature (Ed25519, base64)

SkTMWPcppjmmcHhXxBz6/bvNjmHn4gClQ1ZXFQebD3+MjIhcGgfso7OknsePZn98pzzL3hiShcUdxzQdNRv7BA==

Merkle root

f0c601bc37f52c70ded17f76faab5612e674bc087c8faf99b4d2f53e921c2b03

Merkle path

["041608eedfcd9535d13970e104c2608df1cdb3299e128d570b94c1b1e0a9ffc7","a5a92dd6b1181d2bf618733aed660f5a92828ce99230ebcf8fe2137f1601292c","f222a24a63cc575298126e5477a765eebfbb02f751edc54e6922add5b05ac336","010ecded3c993cf7b16184eaee67677b62d298541d7dce42365f1a8f1d26f230","71d64dbef81ddcf9b672ae898ebeac89e14113575f33cc2727886a46d85bfb96","e79aface06c9dd77b98807710527afbc9cdaddb3b520ce424d163f2bcf5ffe95","b9c72d48c52437c9a1109a91597147cf10fba89bd906482f11d44e68c2fe304d","4bba73329054d036a5d96f3e3fc450c1ce124c6025cabbde877515dc4609fd09","d42cb19a136e5fc9607f8a35ae81b5cc53a0fc0dd2c6a7e841782a93e392f844","45f35d45babbebdec3b65669de9afd1bcf5a6e64586931922a5d69da2a6d6b15","8859b8db6506a12acf6198606805fd64f9576b8566d186e1174a6ea1645fb682","30261dab0822e00dfa6c3c3a33b3d063e3d38a7599dc6296431bd59470ad3368","63626d343fc27f295a2ff318756408f19fcf6ed8639844617fa9d1e202804a12","ec79f032c08fea2de521a7794f897a556ed84b17f8ece659b547d74d3137bc36","d5f5465b6d70ec9eb5fa4b73b511305c1b686def0c98a0246e8a4e9838a04a81"]

Anchored

2026-09-01

Public log entry

search.sigstore.dev, log index 2671768867 · entry 108e9186e8c5677ac984…

Expected log hash

bb91227cb78cb3334e4fa0a34a7640fc05bd48061b2bb5126f5713e7d64ceade The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1788238642169","kind":"published-quote","locale":"en","page":"brand:smallpdf","quote":"faulty file selector","rating":1,"review_date":"2026-08-29","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.smallpdf.app.android","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (f0c601bc37f5…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.