Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I converted from using LastPass after they had so many breaches”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
12d80b9f4be317729b22f4023fc51d73a3de2914d78d7c3d873f963dc407f662
Signature (Ed25519, base64)
7YVNaL4+gTw04Q2fafqop3ETOpdKsn076HW6g9uzMlFSFWgAY+BP2yiAG47TcFN3nchH/v4U6rLqTxB6ObdzAQ==
Merkle root
97834906e0f396a2a898c3c84b9779decf7f82b4c777ec0274321a50a91b4a3e
Merkle path
["12d923572e43cc5163eb4d91076262aa4f8592e985b76595b8c49564be9372f2","25c997c3c280954d18858867188ae70c518bf815071fca075665ebd22480a307","dea02d2c380c662ea4873faed82feabd4b4a46940b34f56699bf44b84c6042a4","32672c66243f188c5a305572539e006bdeb9da272addbae1bed4135d58ba1ba8","6091fe233d983e4425571c640ed7f065e17bdc0410b33d720509fa1bd2754c38","85dd31ee98727a2b05e6139d5fc6a14b98c57e83e737ad92d295c2dacf17a0ad","00f71198fab2126f0348be4e588554229c6ac86ff8e4ae38a314ba6c7b2d7099","c4c5f656103f5c41d82174774c5b54e91036c77def6c8c8f5cd677b1229a9d93","020db83199fc5eb3691044e74e3ebf5d3ab3d1278318b837ef3c89dbfc627aca","37f62b7e28e0f77a786a27f031f35b46815b4153ad6c7c4d5da6564d07e86eb7","333e1b291b35b779bd8769aaafaab2e4879b0442b64f367b3854c7dfc9e9d73f","cd5985dc942dc066cdb074801911565aea14ac0cb7ebbc4b2f477ebb49273066","9e451ae1190daf793986452fa75815e01a9560b27b1cf6d44b59996d2be9d5de"]
Anchored
2026-11-02
Public log entry
search.sigstore.dev, log index 3637495315 · entry 108e9186e8c5677a69a5…
Expected log hash
7967f0a54a200ce65e58f0ab49a25f2626f4cdbc93b074229fb004a3c94f4a58 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1793588326916","kind":"published-quote","locale":"en","page":"brand:bitwarden","quote":"I converted from using LastPass after they had so many breaches","rating":5,"review_date":"2026-01-03","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id1137397744?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (97834906e0f3…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.