Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I can't use the app for my work now”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
2c2199a5e21dbf8fdf672c17c14496a5a6a0dde1db62c083a065a5cbc8674e4a
Signature (Ed25519, base64)
JYh/tb7gAajHcHvdPqfBwidjuYRhVnLySv/xFE8siTNLBjPewTFvIiG9n+4XgHMQzHlexFZXrH2wj2O++zt6BA==
Merkle root
c481d62412848235567fda063ff4784e8e49df41ad8b5c570de24ba396415d22
Merkle path
["2c248e14cb065f00d5c0ddb7d2472cd16ed18942343ea7f3b7b6dddaff5c65d6","bdbded6ec0ab5d96244e9a8d343d909d77646a9fc302eb520378a03220414f5f","a6e0d0516da0d72b2cca0493d0a4856f7b65bcfa40469101f656a0d5b6a0e6c7","f4b1a16a945b0e1d6bf4042d5dfcbb27c811b32ed78d9c789e14979a33b7fffc","3635129c437bdd761827a621fa671c4a116ea0d768189109f33856d30628cc66","129940ed4f41780dedcd96ecaa0a4ce12eb0c18b1c8d4f8b6251593c90281a82","f5a89f2f2d3d0e9699e81d43e5b1b126a86293997362add39fe579f917847506","2f134e27308a00f90d96d56312ac2fc63a96d12d7aab6f43096baa4711913c01","586299ebfb751166fa1f79c19ca0ecf4532a52ee73d0cd4081b29ecf935877d0","b5901d39657f81797ce1f1b515344f63dc23f883e6729b5da19752dd44675f10","037c5108b45f4dda75818c58742be131876ba8d358dcc8cb669de138c83215f8","561138a292ac5e055874c6350bb92a5c3a0d1ad819d0ef5aca78b9282f712d50","8e2d739e7baaca5eec7f3b63cf14603ac9110107e45e291795e5962b0aa5df6f","ed99a4b837bfc052822e7d0dbdd9c56431a87e8600550f5deaf9f7068616c82e","0cbfc145d581a4c4b7198ff8f397c34cb4ba6263e9e9892372f878302426dbe6"]
Anchored
2026-10-07
Public log entry
search.sigstore.dev, log index 3124493015 · entry 108e9186e8c5677aee70…
Expected log hash
0056b042c00529af1248b70a0a2fbed761990dd7841ea722369c29a2685ea6e1 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791350987184","kind":"published-quote","locale":"en","page":"brand:xodo","quote":"I can't use the app for my work now","rating":4,"review_date":"2026-08-10","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xodo.pdf.reader","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c481d6241284…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.