Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“the only way you can use any of the features is to pay for a subscription”
Google Play · 1/5 · 2026-06-15

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3140627354

Proof data

Record hash (SHA-256): 0560e415af1110033bcc17b4c61c08f143f351d49c2b979ba0fb51d68ef3d9a1
Signature (Ed25519, base64): dConxHpy3kfKHIuqEaY7w74ZTH5X/QzcyOwqObOw4Y5PaWl/gGrjf2RU+7zcFww8Phpui4Gt6bFmmTd+tkj6AA==
Merkle root: 7e5597bd3c162c8b6d828ec7450367f642ce11ee386de414b88376dcbb621ae5
Merkle path: ["05643c31cb8b343a9eed7fc8a73e13fea291e5d7f812af2a8dd80751146622b5","98ea9c7571ed7a27e5a85e77fa231d46eee99cf506bdd26e3b3a2da9a4c6ddd1","80ed8a78166fdb3757f08062250e703ed3f205c7888cb788c4feb72663337888","b7c4bc559b4742f5d8a185c3136b52ff63aeb30ea26e34b7de6a3ccd39490566","a054c1ccbee06cd852c65bf2891daf0b573ff6110b5d21410f0a58214a01e840","c0b74949f82b062ffc06c700a180dc8db1311a676d89046fadb02de1f4b204b7","ba691c9ba5b58d35c0feccf3eb492452f68913580adf3fdadf50d5447039b4b9","c903521c4e351356af6faa520e195950c40be82ceccfc5da328ba117ffd4f489","7a9bf4b7397751587e104ea751d451d224151c997d1e582d9cf912460554cde1","495389d6911b753785c91eb118b711a0c675a1b7b07a6a3899270a48feb63542","ab4ecb47b9931c116148a235be2e074cd3889742c4f67e457cf53306f3aeb55d","5b342c675b348d4a0b82d232b6f1d1714e25356f2be91df3e28c6411fce40f95","792fea8d115ac482e9fef70a7069e557f2efb1af634e94e47f08bdc3862e5a6a","acb249623400215550cc0881339acc244e91fde1fa89bf36124dd51a7bead968","76edfaff3d5907039be8c493f114c2f6ba10fbab7705dc7ab77a269ec79893bc"]
Anchored: 2026-10-08
Public log entry: search.sigstore.dev, log index 3140627354 · entry 108e9186e8c5677acc98…
Expected log hash: 82c9bd063e624267c60865e2416c3d714724e2c3b18c4773424cdf17232dd6f1 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791432333296","kind":"published-quote","locale":"en","page":"brand:xodo","quote":"the only way you can use any of the features is to pay for a subscription","rating":1,"review_date":"2026-06-15","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xodo.pdf.reader","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (7e5597bd3c16…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.