Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“changes are not saved”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
1c43a825ea2824101ad0aa411b3770988129da8564008a06f301c5e9be1006c6
Signature (Ed25519, base64)
GJcxMgyPqBoEibr5YdWku0KqYjhHWup/jeODeohbrx1FGrMEt+Nx2Q1I/Bj3K8YNToOcz8lF1iDY2rX8Zt/pCg==
Merkle root
954962254ff2eae9503796c02bd08deefa3a5722e4ac0b3981007e2b9ddd84c7
Merkle path
["1c3ace556c3a8f8cc8fc48ccb9e340ab5bcb7a2761d3a18ef6b679dd8e86c8a6","b64ce57aff87ad294fc9d9377c0e24a258a087d2263ed861e1f372c3c327e620","ef7a827a93f6a38e7144edae3e7a29ab84ef52dd9d19b3b3d59cd46ae05208fe","0d8eeb78140fd221e1df2f846f11b0b1ffce9b79f0616091d58dc4029bbef982","b952422266457ad460eb8a443771865e2a13e3fc53a6630afba54dd367b5ec9e","548314cbfd9f81ba47d87a167acc2b055dd6df67bf0a5cc7630a15f5ebbde1fd","adecaff3b22de153c8c8cdacdb417ba70270aa819d7d0fcd51c105a01f169f83","8be43b4b1729fdd16e84a59c6a3fd460d2ac8d8870fe5326bfa2a1a46dac4dd7","de834b5d986f58a64f4d7801ebef748cb8f46dca429e86a91ba4b3231cc7d62e","d36dc94326cebd82196e74b3e20a9f7d219e7890d1fa4a313d92037293bc835e","a4dd75e23af0f1258e45b84db6627eea99f30a1657c6dbfb9ab7e1aeb6c7d199","fde62d346ca93fe6ab586e87195f181c2c9b2ffa2c14b8bfe557af9f131263eb","07b2ba787804bc9fbb84c73bed76b7f65ff1b8c1694261a8264cf5f3209f315a","e7bbbee54f729cc449b73bfdd383c96b7b180e618c270037b5697f1fcc75f254"]
Anchored
2026-10-13
Public log entry
search.sigstore.dev, log index 3239939960 · entry 108e9186e8c5677a0082…
Expected log hash
28fd9464b857a07e61931e67235e692cb8af33d7541a60ca163756a54a64e9c2 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791859824762","kind":"published-quote","locale":"en","page":"brand:xodo","quote":"changes are not saved","rating":4,"review_date":"2026-08-10","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xodo.pdf.reader","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (954962254ff2…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.