Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“never been able to use it since I installed it”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3666748782

Proof data

Record hash (SHA-256)

2ae88d03113a48ab7ea1742f85a3d5842916ee01031744ddb3be53f1410a228e

Signature (Ed25519, base64)

sNdZHPdee4w4fAgiFqjysB3+Cm0wtMAmYusqpfqt5AhP1X79rQBrV8pH/3HaIOeUPk9Rnah/vNbGAj8EvFplDg==

Merkle root

9f3bf01edb9d597e26c01d8c9281f8ebd9083c8348fa27bf99e2d3d27a8b9c8c

Merkle path

["2adbc8a2122d74a0c63862b309d2a677b83e47c44a684b26b8bdb77d0b22dbb6","e8265c958995ad1ee3bc9acdb157193c404a759ca6c2b068feed328debf1baf1","5aae5b87c4eea034f5bc7a38f9e668fe11f144a3bd1c12989cb6b18506d87428","c3fdb05b40363907096c246ff0c4666fb9cc4d06437608156cf23c694544093b","dcac4f1fca2d3176263c48bda71c38df59fc16ce5f10fa9c87e931b9f023412f","5bb365e3b702b7921154f19ab80107951a8163dc54caa56047ab4bc14372bb5e","7c0881dca101cef13d75fe003a0c7772598239970dd4c217a946249909b6b8eb","24fbad74d40a765d67e84bcf1b7e85a555698ca8c346f115852fbf06ffadd352","47d765c0f79b0c871454e3ed2e130104162c0ee289949ab63f06f1201fdab5fb","db8e072c7a60c84d42900b6a2994436be7f9e76ad66cd0131efc7f288366f1bb","e57636c84311714eceec5b709d8e9da0d927aed2ce3e1ae58d85730ecbb2951c","9311e5bb0d47db2583c7dbd405f5122ce8db6d1193bd1174bd29dda5341d2dab","ccd3f6a502c459e3bafdbecf5a4380782b0a6666d918776f3c595a5cb05f3e9d"]

Anchored

2026-11-03

Public log entry

search.sigstore.dev, log index 3666748782 · entry 108e9186e8c5677aefa5…

Expected log hash

5b49e28274358602b99f52ab121ad302428fe63b23ca19ecf9d795208846c99b The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1793702050700","kind":"published-quote","locale":"en","page":"brand:xero","quote":"never been able to use it since I installed it","rating":1,"review_date":"2026-09-01","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xero.payday","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (9f3bf01edb9d…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.