Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“The software is complicated”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
0d5b28002a370297764efb8ff0fa556aa5aee0e55f48eb7462d3091ad8eeb336
Signature (Ed25519, base64)
bBMC+zpWjP9oDrtL82/i35BFAWLDV+w27CP+G3VKkVuVfNmJNre530bWXeXV7tp5RJ6tDyE8RIbBy3dFXfhdBA==
Merkle root
fd6fca9e7cef37aada941aac92decfcc64f6ccf1f80e46f326058d1dbea3be25
Merkle path
["0d57441dd7284da77d41ee8dad0250bf76920efc4538285a1f3b1742df1a7d5d","0548ff0205670ede2e2787d768407a13b24bf5363991975c967e14a5834efaac","bdaa07f7116604d5f1ea14327f7aa6eee109c895ac0acf441ea7969d5a980197","67eae5d96629b2b9d437f29ab9a235719e6de321032e78a2c94c43e94167a212","ba8eb780d608a3f34f02981db3ea75dfb4f6d20f45caa4b3d16f383893e813e4","558581e627c499278a1a4d91324e1332ff2df0666ac5149dd26e05760904ef01","c5337f7c4d6755d40ee39d9efdeddae9088cd9f312e95db4be3c55d9df75177d","dc0de3c411cfde1b420f354f609e04cfc631c0c5922e48091e65110806dbcbe1","398e81b6fb7be7e122cadc6bb30359a5c4f92df2977193555ab31a0b743b912d","0c25b6c81f278aa26af2b67df996075595b698aa6343f53dc05376aaca0da2e8","837e21a65c2e7e9a1ce78baaa0cf6b585e93b4b3d71a69b16e8ae761b6912a16","9920afaecdf2c0fe347b654bebc1ac5233b2ab1d10b2ded7a1a817299c6d2453","f88aa868377e782be92c7bc17cca7fa56bb539fff729ac4b230ecbae8fe3bd50","af8b7672f7140c4d5f8cf5a204256eb8a0fe0ba6770180d832059e5b511f691a","d2a30b01208ae5f7745e5c8a474c1f34f9628e43b7a0d1b0d1ac6b378b7f866d"]
Anchored
2026-08-29
Public log entry
search.sigstore.dev, log index 2632025295 · entry 108e9186e8c5677a7e39…
Expected log hash
327cdca6f67e0b8900de427ba632e65f297b0edb716ae3a08de15ff81c0cf3b3 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787971088504","kind":"published-quote","locale":"en","page":"subtheme:cewe/ordering/photo-book-design-software/en","quote":"The software is complicated","rating":3,"review_date":"2026-06-17","source":"Trusted Shops","source_url":"https://www.trustedshops.de/bewertung/info_XE3D21EA81A56276ACEED1C9AFB85F941.html","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (fd6fca9e7cef…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.