Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“ein kostenpflichtiges app”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
080e3f371935dc5d0b83098f85fedf091b3f627862990d4ff75a2f7da3916de9
Signature (Ed25519, base64)
xgu+aRZwMG+5/Rm72HvLR5cJisGO52BsHHVwHqwpZH1H8qyobbnc+BuyBCTpak5SPATw+hIIlLffmjwOPw9qAA==
Merkle root
5f465603cfecff8c631b83258a9f794433a9fe1f55c92c7f2359c24d5239d7f1
Merkle path
["0810886f9b6ea15d3c548e7509ad84e980630f3b2b49b28c6132a69b2159ae13","674b32cf968f9a700f70265bf3edbcdca260075955afd7bf87e0159afabcc76a","03bdbf19cca195a5342221865b856737bbce5bba53a54edfb959b9fcca6b2c6d","6fccb782ee8527decbb10bf58e2ce7c9048444cb142854562c73293db516eeef","0ed98de84d60915e328880bf7cb73449dee6b9b0064c5f8b82b0186d4c74666a","9078f95dc89153b0edcc5242380f2b551cc46e6e4e94a8a3b04a0adb878017e3","29f159da379ffe15ec2c7650111956960a2b1ba6849676105c696c0c925ff8ec","c8fc35668b5cd9adcc03ff95d2f8a53c6813731f98cb55374a3844dc156ce822","d7c84b4f006c9749358aada5f296e725a476a1d82412d627797477444fa64982","928eeb4788392c689f5464ef96702fe10fea715539dc35b32d3da60ef71a5f9f","8e90d65bc561275b545eaf68944bf927d1435655a5023f6edb84cdcd36a78d8a","2caded3e2f34e05ae3efb016490f55ee18bce7903453e7336b0bc133b0f71bca","f263180059cdec95b93f28a9a635234e8f009df51d66181b902844414d966b85","3fb39940a6132e03e4fff826dda6ca0582558fc639bb5eb857201917cfd7b8b5","fc87a80257c5f9d9cefd8e12d2bc08e25e0ff70c414cc5debe7f697d0b1cfbe6"]
Anchored
2026-08-17
Public log entry
search.sigstore.dev, log index 2495157846 · entry 108e9186e8c5677a0eb1…
Expected log hash
3272f4e3e87c1e1bf0369f64c72e7fc63fcfccb2635eca462b023cee408b7ecd The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1786935515462","kind":"published-quote","locale":"de","page":"product:smallpdf/smallpdf-mobile-app/de","quote":"ein kostenpflichtiges app","rating":1,"review_date":"2025-08-07","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.smallpdf.app.android","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (5f465603cfec…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.