Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“there are often bugs”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
090e004825f888683b3feba399cc14a002c796bd48b81faaf599a2b9149c3939
Signature (Ed25519, base64)
QID22fYNhmIiUInGi2mERMzhtyMpI51MGb3/pnA5+33Ab5LopR1/TRx4UbWWhCd497V7RcgNJXYDzRTdMapNBg==
Merkle root
897094661611c7f6f667565ccf24b086fe433f50853a89527920398c9b990be6
Merkle path
["090ed0e239b8473bc3288ac618c27271c688e5aacdd8f68cdf21126cc48b5a17","e29954a52d9253622fe38096ab643f630310b20b90bbe090af1f0ae83ba6d791","21b466460934cdcbda882a04cfa92da578a5671295a402a69d3155c44686fef7","fc8258bd783f91ede7701d2da95eb80e30140bc8f0ff7991558f097b0d1b88cc","d5488864278807e32480be2bb0f0341481609eaf1ec0bfdbbaffe7c5f25f4e80","6c21383fb013c660b497d243caa27f6d2ec1a7b88841330bb43faa60acdebf69","e83b09117eb011f02872277f78c7505de2450b1015d9dcee58ecb25c540cae2c","7fb30a6dd46b98a0ab04f6be957cfaabf68f79627da5ee79bbd594e7c93eff2b","a083b142cce5baaae34040ccafa6f70b4efaf5d08d6aa9f062969c19c31eb0cf","56ba73408dcf1a6da699d525db57c429f06e633d0a87d6cef1aca53bfb20a5db","d2e150e0b74dce391b7c671085a2b5174222d72304e2460cea099bfa8d859f52","7162e4b99aa61c838147d793ec2d190efd35afefd2843d09783c269d2e52070a","5736b14a6ee95db57eb4c7d974614539ed67fc54a28619dfa971729b31256280","a1d9d348562bb2a87e7320356d42d9b0f701087c10d37ebf1716b02890730e63","6bf2266db580f32a2ce774610d26c445305bbb4615cd5a57e78c4156611f45e2"]
Anchored
2026-08-28
Public log entry
search.sigstore.dev, log index 2621546391 · entry 108e9186e8c5677a3763…
Expected log hash
ce42e5a10ff40e11caca7d6020944d319ff4f139546f9e6702c021de8b61d36c The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787889108108","kind":"published-quote","locale":"en","page":"theme:smallpdf/quality/en","quote":"there are often bugs","rating":1,"review_date":"2026-04-15","source":"Apple App Store","source_url":"https://apps.apple.com/fr/app/id1485259500?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (897094661611…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.