Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“App update”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
22eaa8997e462923ff2f0a92ef8958a9744232cd9746a7b55f12183f5124ba41
Signature (Ed25519, base64)
D7vqLSgTC1kt73E3Dd4fVONY+pTal183QMI62X9cRpg3laTjqYPqdQSEHa+v/aFyg1OSM31hXCQaWldoWVIvBw==
Merkle root
d312d00ed6ab2beb6e18f20d8087ad3474eb8b04b26d5ad949e9237bf3ca4c52
Merkle path
["22e9c79fdecf4082d6728fdedd8d2cdfaf31c1950ccee7723507c97979eecfa0","05346a4f4f6d53f381e25e6ac82c3892023e17738f1f6ef8d1baf235b6469c3d","6c9eac0b919a0d9f0caacb80a4cea4e7bda977f41bedf043d15fe947d608fdcc","60d2666db17d8e97d0c321a169d3673bdefba32149b998bf23c0231d654a6b8b","9c61a01ad81bd8606960eacd7d6016c48f23327fc743884b3948dca36a087b0d","87564e9250939ba643e3b5f32c96970dc6a9a029e68d2d01cca6a54b6bb2b643","861b45fdd4a6c2ffd4e75d04d252b33f2d59942534a6d610047f464820d77365","63cfe3b0c3c0dba49a59b42101a31c5bbf1179275f2c51677729b0dbd6d062e1","9138799fb231e06febb766c764b34bd84b1600c6832d3b12d19c84ec49309681","9bd50fbd26f91aee15a8f5601046027032a161b6643a0272425d38697c95150c","42ca341c426ee2aaf9063f3f3c8df6a6c7a736d655abbb6e461049a797217e2a","a7ca37fa96a2f7f86fc75e6a69e63a272421401e812ec6c961aef9ff5319b34f","4568be9f5fd943a51642cf1216eea7e9c24c72db1776101b5a3113d15eb8ad63","c979fe4edf99bdc6f66f54b8524194d66725def21e08cecedfbfba469c82e6f2","2fe1a36eecbe6e65e0243c1a81f5f430e558c99de7c492361bda367e122fe03b"]
Anchored
2026-09-29
Public log entry
search.sigstore.dev, log index 2991846025 · entry 108e9186e8c5677a5f08…
Expected log hash
321e41cd200068478c5cf6f353f00dbd75153d3d8a640e241b1a6e8e4f8ac2ea The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1790574513694","kind":"published-quote","locale":"en","page":"brand:delivery-much","quote":"App update","rating":3,"review_date":"2026-09-24","source":"Apple App Store","source_url":"https://apps.apple.com/br/app/id917686123?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (d312d00ed6ab…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.