Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“This app limits PDF merges to 2 files.”
Google Play · 3/5 · 2026-08-07

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3083528439

Proof data

Record hash (SHA-256): 187403f6ba7f4840d57ea0c32c16bb8f63cb54c8d9a97acd724fa7586c24b6f4
Signature (Ed25519, base64): AXXGr7l2mCeUnHq6yr61PENL8YYGVD2TxvIffR2i9LoTyrsl0Y+758FwVWJN8W+M4SM6naTR0T1Bk5ik7wPXAA==
Merkle root: 3ac2a65164a98b25d6607e9cd20ce9559bf4391886ca2eae943b9792fcb8a323
Merkle path: ["186f91a76069348ec6d67b26261f3769bcc9c2642c8e9f1624a3eb98ff30515b","c1445231599e486f7daac6236755d7d22665ab90b0afd1cd5537d51d0702e9fe","0b0f0b3c88989c12b6eac17e9d8081d61013a01a8611be6693fc4d1fee443690","ce3a6e2b4e65bf88fd25d65d2389bdc07da232b4a3f226dfc72c4e8a0fd62b26","333198d2f7ea9829a335598fce357b097ea388ad29916ebfd28b1a2b8073bc87","10e76e6454b40e2f2c645810aefde15480707762e935b6e007ea6af15a33a557","cecaa8f28dc094b18e4d2f47362d5d7ff9dd1b4fcbf396963654744c0ede76c4","98d5ad6bd6bf96c21a65968bac19bf56f8387168f30b585316a4d5e77b900511","7a929e6b820aed9744e5323886cf719b0d94c5b78324224855965c58564e371d","6d355bc6c7a473e48d77e6429ea792d51f08880170a4504873c8f912edf22421","3d2a03a5390cf71e4ea6869eea7b151f3d3e7d4d50d01b6a113f3ecc992a6ca3","b01c2625d7d6ed6aba617555d9c95bbf2a7043e740344450a67b0c797701de10","309aeea49736ed841c0769a3c166809b978b8ad00b17b13cc0a57509820a4b01","900a8ed1297dc836a8b3be52e4e74bbac6319948157ba123cef010c147d9cd86","b933f107006d8bf043be83ef3bd88a04368b06893809d6915935ad1f675c78b6"]
Anchored: 2026-10-05
Public log entry: search.sigstore.dev, log index 3083528439 · entry 108e9186e8c5677ac4c0…
Expected log hash: 8816bf48c9e6a0b1ef2758b04fc7021824819cb4cee30b879cd603a10d38b8a0 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791181418024","kind":"published-quote","locale":"en","page":"product:acrobat/merge-pdf/en","quote":"This app limits PDF merges to 2 files.","rating":3,"review_date":"2026-08-07","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.adobe.reader","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (3ac2a65164a9…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.