Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“it started asking me to pay (stating my all free attempts used).”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2612284956

Proof data

Record hash (SHA-256)

107e6e586dac3a0cc1adc70d41afd834cb20372fca92be9dc3f8550242e25090

Signature (Ed25519, base64)

vzC30Ig4/qMUrGqcj3SPF1qdaTM2LZarZ81rG6SXbmMxw/0wLCvL12+HsQsZJ9t4q5xSm5EfKbGKWk3OQVwXAg==

Merkle root

f38f8904a05de694c6e6e57f469170363c186b63988b16538157b391550377da

Merkle path

["107b0aee70aeb4eff57248fa047cf08076a60ca3ea9c82c69a8e070391fe009a","efd85c0b759691d78323f3a4cffe73b7c261992df27d27d34a5d9ad0270b167a","d1b85e2751f38865a277db49febc8372f02af539e312c208b7e1265ce18b4c81","c2a936a7d2c66f6757d5922c87972cbfe181ff920ca73a75206503fe1a5b411f","d2611c59ebbf237ae2fcd50dedb4301c8ac3079365537dfebb43e0a5d31e7c55","585ddde3df43d9dfa6372b348c7ef879488f8b531182166e9eeb6ed83ffb1035","02993dcf46790c4f2dbde996494be6a476fcedd26b0aeb66777a384024cebf59","8c33c830eb3e891ab332b15186f62f9d9199a0db079d7d2845d551162138d223","438dde3e3b26bbfe4f3ef70c0cdacc5aaa14b6b6febee95d2aa0f97738013233","61753502276dcee59bef26b5fce9b5fd0a61918a0347a320fb3ff41d6e2aae3e","575ba8ad3bbbde6f83ddfc6376e7e5d741100a550fd1f358e6dbecf6eead4a76","b7e823da7d6ee89998200b8ed35eae781a25b00437aa2fcb75142fe4ddcf22ea","2bf000c88cc8431b1bce6508e73d514bc43a6cd24b2ba59433542ef8888cc163","e4533dce2749228d7790c4470ecae8703c042944bcd79d1df522a76c8f3470c4","363506105d168854fe4696d63de08b4a6d73b966d2ba65fdb1b6dbae6e92d22f"]

Anchored

2026-08-27

Public log entry

search.sigstore.dev, log index 2612284956 · entry 108e9186e8c5677a3e36…

Expected log hash

d95595121700c1f4a1721dd1280bdc6970a7fa601baed76ffaca595721fac7d0 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1787798682688","kind":"published-quote","locale":"en","page":"product:smallpdf/sign-pdf/en","quote":"it started asking me to pay (stating my all free attempts used).","rating":1,"review_date":"2025-02-13","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.smallpdf.app.android","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (f38f8904a05d…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.