Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I still get notifications for emails even though they go to spam.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
20eee6d448aba6b1bff280b3a41e14d8cd3a164dcf14cf0b84b7032b5ced215b
Signature (Ed25519, base64)
RCBJzY4PDT7KUm3BOT+/jTwB8h804imI8AI/J5Utv4PU24474/hBl48LjvE3NY67sQUKcc9g103rHm1X8H0aAw==
Merkle root
ee5cb7d5466574a42af50a5863f2e6b08707c3d7337d478e2a75ec5974817ca5
Merkle path
["20e834e0e2f03c7fceb362262810a57f898a43b1e86e15b3eb22eec8c9fd3093","4928694a4e75e7745241feec5549f2fcb5720d9cb4ca7c7fc95a3752076b9273","6d93887559cfd2d783dd587e61b2d9d385b6bb1f481b1d52e371cfca7b142d8a","2b34cc702e00c0a36db5b1ca964f5b4a75e20473d450a68ec0c24dfd018624cb","7e21937d9dc495dbcd9c550423c1ebaf432de80d86aeb9139fb99eb4c52e40ba","70709437e85d5499d1525e0032c7f03e38be0a2cea6f3bf30c8b91f6f73cc21b","3395502920045368bc0b44494ec50bb63981d687fe2d4bd6cb398b6aad1a3b71","1569993ee0e5057bb865efae46cb2edee1ae3ea5e41868389e7159c9d6aa9362","140059cd22cb275defe6243bbc84a271bf1b8d663dd631cad1fa9bdd403ad616","a836ac51f2590b7a3c3eff97fccd9bc66e61715bd365304e1e9ea5309dc982fc","2f19c33a5e477fba699f9c69468d056a3e008f9835538bdb80831f25adcee573","fb8b682d716abc20ee1811f631582e5ff3ed6a0a594d129431149a8bb1d370cc","2a73db7909019b8ec3460673eae2069c28cd7cadadc50cf37b832bc38db68e45"]
Anchored
2026-11-03
Public log entry
search.sigstore.dev, log index 3668444190 · entry 108e9186e8c5677ac70a…
Expected log hash
6a62ae4e16460222b9c1147d69e44f936572be00297966ae47e1c0e2e60f1a72 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1793705698743","kind":"published-quote","locale":"en","page":"brand:tuta","quote":"I still get notifications for emails even though they go to spam.","rating":1,"review_date":"2026-06-03","source":"Apple App Store","source_url":"https://apps.apple.com/de/app/id922429609?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (ee5cb7d54665…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.