Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Every iOS app that has in-app subscriptions is required to have a “restore purchases” flow”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
0add5926a646a54488aec72dd4f97f0c47706c076c7ea96b7e023c63d7ecdaa8
Signature (Ed25519, base64)
HBWrMJNN03JO7eamEoZ91Wgww9fFqXe0ZroSz4mlbaW7jrSlh59dmshbuq4dSkLZHaofVMiUUpS0P0vwaOs7Dw==
Merkle root
e302b878b844ddc4c01ebde52dd558acc39681368181eeb0600440538713f92b
Merkle path
["0ad8c1f17497d164689f377cf39a8801ef27a1fd9d85575e62386671ab58dfd3","6fdf37edb805d23ce72007476782c5531593abd6fa52b73d62f1847001f1d524","e5d0da4be4dd6ab5d432bf1e968920d65febb9393dd651cc0228d7c45502fcbf","1344a19d1d9b0832647a5d2644760c7953c581300da7e6964fb1577e4cffb411","010fabf361bc9f0b39847fef542f116d9e2fd9c3882484d22894b6ec80a3e727","2d6ded319c55018c30632f3b2b3c7f50e8c1fd4111027cd735ec155e20ba233f","58fa8a4b77d75cd066897e47ed384a108142af26dbca6326198fb1378901e5c9","a85b4661efcf50805f682f746ace762adca3f0987adb3322032aab982c3d7cbb","540b8bf424f04142c92f2c25f654c302b86bc29f24925220ec13eb21a7181916","b7c1edd47448e27de9991317a50078adbef20c6dd56f8f10d1184d44cb60a215","cf8978cae81647972c0a15d01c13e345d075e060245afa4e2b7fca2a97c1f424","a16debef883d10ff0e3a9e02292a98bba98acd12938e6d61ee66f46ad60dc0b3","b37050522ba2f37d0ddfe2676968e2985c7f32e0abe1ec7ff7ba6f14a184838d"]
Anchored
2026-11-03
Public log entry
search.sigstore.dev, log index 3666350239 · entry 108e9186e8c5677a9668…
Expected log hash
d75c7ab37dd891599f542e30de9c2c50e9ca3ac46ace45bb971b20e677a04734 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1793701017712","kind":"published-quote","locale":"en","page":"brand:proton","quote":"Every iOS app that has in-app subscriptions is required to have a “restore purchases” flow","rating":1,"review_date":"2026-06-20","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id1437005085?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (e302b878b844…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.