Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“not letting me sign in”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3239939960

Proof data

Record hash (SHA-256)

0e9575093e69b54f8a1ddafeb83dd203c884ae1b8871a5c31823e2f413ab6883

Signature (Ed25519, base64)

0HPajyz0b2a3cP+wj/ETkqqtZ56LMQrh3AQF9Jz2Vf2bf4VDg/SxysmPaXK2inr9nx0iROYRxmMpowtsYNbFDw==

Merkle root

954962254ff2eae9503796c02bd08deefa3a5722e4ac0b3981007e2b9ddd84c7

Merkle path

["0e8edf5fffde5f1e17d306b21bfc113b9bcc41fda08df0fa70d73744d10483b2","e1c2e47b9f6f1a5a6d5e0d266e1d29040cf60b1adb915e149a5aecb904ed6410","1f6e019aae79f2aec0299b2ad870a430bb6b3611b8c6d6215edbc573cacb1135","f4780ad6d30b917b91cb86c64e432863e23bbf2e57b3fc8a664d222bfb66048d","4bc9a1c106fb3f90d255227a31076e5d6b93e10e9fc9043cc5bf5b5d0dcbcc1b","3b9b8448e7967fbd4ecd5bfcadf5ae12b18f2f9001136742f66cf3060e37312a","14ec0e2b30fc71d585c0bb29820f60422ddfbdee569d1b4135dffd294a57f04f","5110a6394e1cf5f521e7739e0d9897c906c2c5407d03750f9c80e034e4522eaa","541153a0f548cfd6fbf2fa9c5866de2827b6789b74043e083df9f76036e52a9f","873a5fc80ee5b1be34dd5bc63b4383fc1df58e58069b1615fa2265187a379a79","ae0d02eb4672b68d3bd901c75d5395c5aa8f70e1034007ed320cfbd88eab7b1b","fde62d346ca93fe6ab586e87195f181c2c9b2ffa2c14b8bfe557af9f131263eb","07b2ba787804bc9fbb84c73bed76b7f65ff1b8c1694261a8264cf5f3209f315a","e7bbbee54f729cc449b73bfdd383c96b7b180e618c270037b5697f1fcc75f254"]

Anchored

2026-10-13

Public log entry

search.sigstore.dev, log index 3239939960 · entry 108e9186e8c5677a0082…

Expected log hash

28fd9464b857a07e61931e67235e692cb8af33d7541a60ca163756a54a64e9c2 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791859824762","kind":"published-quote","locale":"de","page":"brand:xodo","quote":"not letting me sign in","rating":1,"review_date":"2026-07-22","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xodo.pdf.reader","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (954962254ff2…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.