Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“App is better on each update”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
2fd0a417104bbde6a10c6bad20c3eb253410c6f3aca8a60f240f07ac32d0fe8f
Signature (Ed25519, base64)
36C3l7w5iVdM2dq521wSLyIXp8REG/mg3rg10L2XjnKcKZ0r7KUF63a8jWaMEYNf5L7UyGHd2aUctyplejyNBA==
Merkle root
fd1a602e44fa6ba18366d47a3f265e8867d3ace19a93c5a056eb72338ad99351
Merkle path
["2fd77c3f6ec381c40d3e6687af705a3461974899d3f4183eb4953a7790030856","b82c081afff01b8bfb04045b652cf654833ccb318b3ac2ee11060a5a838d9f45","b1e645f14144310b891b97cbb370f950bc3fee174c1f82e7f36dec35288e9f8a","3c7fde1eb25fdfa1fa21861c64c0c18e738f8c9c6fdaa408707bda947960b272","94975fb95e0c2d7137feece8f06a3ad4228a310cbdc34c519ff7c8f68c1b3ecd","086fff044e1f6f2ff6ca9babed64ecac81404c0594394324022ccf8dbd7148bf","e77d13ebf4830ba96dbf0a569eb3803b58798035ed54720c766f55aff9e87b0d","fd3de9b0cd0369e7be50d6ef75c0f1741b4ab664278a1384f322757ae7082c13","87b85560b3d5fcd744a6a8827648aefe52471149ae95814e1997cf29a2aed5e6","d7a6379295df885b2bceac738ffec6a15ffc733d7c7547fa27f5251342b131bf","cf6288f16779bf391a745471b992e689716caee1daf5958917e41978c8f13888","2c821c99a404e3bf7a80f060bf3582896dc9e719ae90e80b7b176d1a3217935f","b8f90d250d9b02841259d1e30ed0968d35ada2dfc556df1cdabf044a1c7831d3","2378b1f4ffb68987809fa6edceaf7a29de059238214cacdb28aaf8d4fac29206","3892c8cf6eab6a42602f82120d415bfe3619d03fd8bb7ea92db6f133736d9c97"]
Anchored
2026-09-01
Public log entry
search.sigstore.dev, log index 2671573458 · entry 108e9186e8c5677a8dd1…
Expected log hash
5a4f32b3215d6831d3b044c579372ade08bb930ab401eeb59812a3fb27e3086c The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1788237136291","kind":"published-quote","locale":"en","page":"brand:foreca","quote":"App is better on each update","rating":3,"review_date":"2026-08-30","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.foreca.android.weather","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (fd1a602e44fa…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.