Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“This is a junk app, not usable.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2658211220

Proof data

Record hash (SHA-256)

2dfe3caf8651ec39da6a7a7b1fc48d023b2f98e9b2f4b227b4e02d384903842e

Signature (Ed25519, base64)

4mM9Y0kxI4t9SzfqHhoKZqU2mwHbaHpkELSHev6WtJO+s1nnztUfASm8Ed1uqlDQdRe96ParIvVovmGwidXCCw==

Merkle root

dc262458aa22478fffe21ec338d01c6f4cae4a788ed9fea3c30831a82c06da82

Merkle path

["2dfdad517d8070cd90daf5aa5cdbe9a0d9cec35047f560bd8b83494ee0157245","fe59dd39227a106324c6efdbf9cc0ab4652a6fbdc1d30986561964723a08d454","db5e9e24fa90b93dc67ed7a5358856f355a02a11307fa331770cbcb8a8547e45","90aaf97a18b268cd763acecbf7fab80a2a50126ef5c11b190bd7cad02fb099fc","c9406e591f363fd58fa035e47e8cf91a57298562414bc0a7f607420cb0af9e8a","b23e0997a834339c5a5487304d9f3d743fd62edb38df715b5f023075e6c99a99","fc0ad4ddd92e9c548e8caa865b937e36e159603cbdaf79bd9aeabd2189d81759","452398389c058df8c418f4584e2d5b0d1e8e46e986e20f277da338135febdbd0","ecca2805a8c324a648f8ffa3d96b039b40d1f690127ad88c83beccfb15d6451a","d41579d35410c7dbc46edc5eb7f6045e457a193e4953efc43f6697d7c524aee2","377e1ce5a35f17d3cb59afb3053b223d6e93159dc8201bdf27adffaa760a5f0c","d81e27e13630db3d9d293f6d79668cd1c78632307ae9023530bc5592b492c941","bdc9b750f877995745e1cab86bfadadf81a699dc296c03b30c7a277ddce4ad9f","05b68ff1f996fd6d87089c04d3b63d00c2f9717b69cfa4ae5a0251e3fbd668f9","fa0b5c0e2afc2db7f6b3a78d277777500a36d9f343119b2becbe97376b611a16"]

Anchored

2026-08-31

Public log entry

search.sigstore.dev, log index 2658211220 · entry 108e9186e8c5677a6833…

Expected log hash

34743b52c53937c552d8f13f390474d4daf1803bc63770b1d5dba985fa233896 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1788149612113","kind":"published-quote","locale":"en","page":"brand:helsana","quote":"This is a junk app, not usable.","rating":1,"review_date":"2026-06-26","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.helsana.myHelsana","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (dc262458aa22…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.