Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Never sure what’s happening”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
14e7aab147d7e033e5abdcaaa6be44f65552b622dd33f202962863ee588704cd
Signature (Ed25519, base64)
Ye9P7xtFX+VrPBkZ2+u8qlvHGpgPTiruQzA8Ywq1WS8d7Ig9aBw5B+/e/57x3s5R1V/K4K6lkRVqd73WnHSpCg==
Merkle root
825dbc6ca55f00c6c81d8de0f7a080bad31b79dfa0e721dee7ded0e9c294ebb9
Merkle path
["14d6481827c6a701cc105289dbe18ba597a5dff8234d8f514d6e9c39f311a04c","66d18bcab3d8512310240806e26880e368522ff76ba88ad9789dc83377353046","5b804dbaa7a33ff1e694ac38ee1d5c2d99ebb9eb6737a003154144ed26a2c3b6","635f398387f0e7db747df1f8e3c2f3fea8d931d2c9e6209c2d2865719f567f4d","4fb0420b2444e6027b9401f0656da3ada4509aff40d259f8ef28ae35a52a24bb","046dee1b50eaa105074d2b9285c2f7853035cb5d7c7f9262a8500268912cf7bf","367fe7710b05bd219fb92ae2f7a8870f086ef4abcd7ce67a23c62964b3a09ec1","a4ba04b40a571b2d5f3ee7e335d935efa64456ecd0859dcacfa2e0809a96100f","3417fa32f498dc70b75ecf583ff6cc4d30082684ed145bc752c2c5bfcc185868","1910ae8476868c79e989f65f38dbc68dce63cadb169f02f488e5b2ef60ffe52c","febf287b7c32a2fae856dbf526e351f23b5b8476b4c1b3e342c1def13e494cd5","9c0c076fec2f0fa7c1094b4111d2e5cedc7ac35232c509cd9a25439361474b1c","1e2e9420d8c4747dca96dc342727525f4c47cf2390ef42ad69829fe37156235c","04c4bd8a9ef95bf5648c9d023612bd1f2446e83a6dcf83e612d031a5ea30e90c"]
Anchored
2026-10-13
Public log entry
search.sigstore.dev, log index 3240422411 · entry 108e9186e8c5677a0ea4…
Expected log hash
8667b0db28913263098c19cb6387cf64b6d68b1b8f2c4242d3139d96cef5da0d The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791861703078","kind":"published-quote","locale":"en","page":"brand:nordpass","quote":"Never sure what’s happening","rating":1,"review_date":"2026-09-03","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id1486322860?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (825dbc6ca55f…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.