Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Or team management, since many of us use your services.”
Google Play · 3/5 · 2024-10-17

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2671929919

Proof data

Record hash (SHA-256): 0c07799c48aa7d4b495d512534fa5f580517afb04490414f9d1e28ad3996acdc
Signature (Ed25519, base64): N5lAx9pYIV1hurflwgdVEKPqald72zcddJGzfYjuElZ9Z9ZyEZdyMRmHDhlAKiBKfYPLnE4aPWOPncexnobQDA==
Merkle root: ffe0abae83fe32534ebead9dc4840cffa734701988d7729ea2741c63ce333209
Merkle path: ["0c04d02f5338ffae6497bdcb0cd6906c56934ed7e2d3233f9cebdd95d1267daa","8dee66e208bf89bd592dfad8f6246c0568c270a91911601c57082181684fe32b","2f0d5aab7c768ce0d027f129005040a1ebc3a0a2864daa7a380ec692320c9d58","bedb7917a3521a3ac3cf8db9f37e33d1acad5b9efaf30db30b9c8fd284e64109","8f9b46ed48422060e2f811cfe0a1082e9accdb908fe79f8cfe054101f238ba3c","f2cafffd6a5f674548fcb4d6c01a85a071d3a1f5d51018ec5c9013289b3af71e","98dcdefadf488248c5687ccb86e51cbc3fb8a3ab36ddcf784de694b6506e17e9","0f252c270f9da2c8ef1437688f87a8e0667b4f8cfc64ad10c3ee20f1482d1bf4","f82f48434ccea50bcd1d4624f1c93f28117487cd925589fcd0b68f13a31ecf5d","f04f83c3bfd9d7f31f743612c2c13b577a0ccb23832e0806dd149b75e53a5e0d","73a39a5e974d34bbb8ee3d4669fa32111cd84204b68681919799750207c19564","16a20cc814214b26526f21ee5f967cbf38004ddd8d0ac5579894e33963c2f40a","849ed338e3b19bfd222d070ef2b6f25f2505730ef52ebcda9291b3aef8591b7a","a104e1c95f5429ec272490e6572eeda4db6dbedfc04ee0f94200f459c1d02cf8","4742e9987316174c17377563bbb971469480b811c365b9940f38dd437d53482e"]
Anchored: 2026-09-01
Public log entry: search.sigstore.dev, log index 2671929919 · entry 108e9186e8c5677afaac…
Expected log hash: b7a1aa2befa5caac7007c0b2e7b21cf5f700349fb9119336f4b3c994326ff20e The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1788240211764","kind":"published-quote","locale":"en","page":"brand:bexio","quote":"Or team management, since many of us use your services.","rating":3,"review_date":"2024-10-17","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.bexio.bxBexio","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (ffe0abae83fe…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.