Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I opened the app this morning, and it tells me there’s an update.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
19900c7c6101a5e097e5d4b2b446812232fb92ad46e43e5a69ae0a3ae9db5a78
Signature (Ed25519, base64)
YTyldvatKAkD/jsMgbRffx0DNym/tHj6OKkdkbhknde2six5ChxE/YkXOs1Ur8LkVubd+TB2qoqsBBsJ8/wKCg==
Merkle root
7fcf639a7573b11c0c63296f1f4cad9d82711469135561c27b140b3f8cf0f233
Merkle path
["19b3da148442d94347422942a65cffa6b2ad55cbfb31cc0317c1d3d199a901fe","f2dbf4358118f226539ee785098a9c410621cd0a5c705df169bc2945c2444d1f","1a9591ffb29bf6f63411e518cf5852ff40d4adf240950ee3593f4848df1edbf4","8218483016f6d93f9baa6de071330633c78fd6fdca9d7e4e7509cc715e040a3e","d3f31ba1e601b639f3a30c7f758a673314ac818ac7df4bc3aed913e66b46e02f","1c7ae8f0aa73fe4bacad1ee3aebbbdb711f6fa0fc65d154bb5702111310e36c1","a1bb60eeaaf92b44824f4a60359f60e902407d96e59af117cdee79b029b5fbcf","b0eb79f4bc703ca592064c02d1bf92d1e30b0202c7c72199c40fc4501281e1a8","ab39a169fa1005d37170ebc5eed08e3c7d3531d148efa7db2fda4c1a005680f8","8a633b07599328cf8ed191c20d5874d05db66c6ecc72ba64c742b13d89a02e66","07b09ead5e3200c1b520970718a379d46d297e4c0f0f99a01dde8b4b2e5e882d","c4613c89731736364f3f3856f24ef3babe183ce20545df5fbb70ac024301ebc7","b978843be08c52cb951ca064b6ce98b7a05b3bb460ac7b4bd5d1657a0d8a155a"]
Anchored
2026-11-03
Public log entry
search.sigstore.dev, log index 3666503969 · entry 108e9186e8c5677a89d4…
Expected log hash
8f203023a4c26e044b3b27e73dbe1466d2f19b715af45abb5c7e82ddfacac0ea The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1793701411816","kind":"published-quote","locale":"en","page":"brand:tuta","quote":"I opened the app this morning, and it tells me there’s an update.","rating":2,"review_date":"2026-09-01","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id922429609?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (7fcf639a7573…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.