Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Very unstable app.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3273084324

Proof data

Record hash (SHA-256)

2ff066f9074eb6372ad7cd4ccde2d954a29e86d36a5aba82ac6a530a0e36df77

Signature (Ed25519, base64)

iNzJ9OGv+N/d3ZGN1Rswz1mVrrV4AHHHd1WJp4S4HSS6edcwU7qWzc2SjWsu5mtf+M3Cn3SRVNK7Qzig5pWcCA==

Merkle root

4591ccf5fcdb01ed421243d02df5f30203ce391c077d4ade1ff5ee97e69e252d

Merkle path

["2fefb7fcc50ddb757abaa288a5c2ba7b07ef1496f95ec0de9c61eb05f42eea40","eeb5905fcd02843aeda2345d7f1fba46fc2dc5e5bb2ffef9a875bdb78e97105e","ee822d7367cca3ef8fa8dba35412ee281a77bed75af43f819b899aed265607c8","f1ff964ffdf76ff09eb439cbf9ab30d8938480969eb71b85b49efd3147fcbf02","555621a36130e037ebc9554eed3df3b50993ae8655d29e34b89be13bd3be0fc5","478b4f0b9280ae8ae1adc3cd7b5fb0095ad059b7b6081ee22ca6dc6239fdf28b","6193dd3f77166222d0be1b2315ad41371cf825c9799fd0cf1c50a20dd6c3871c","82e5a631f67a377a79103bcf0c4e9cf8789df387ce16253a33588aede6db129b","82888656e27a16dd9a5c88ccf26d158592a43e5a789820d6431d604ad287f4ce","46eb24f739b389806d6838c3d9c97c0dc973020538e6ebf11b7e6766d62a8d09","76248b44b9ad9d60e7f57955141277233f0834109c44c736c126c5e9ab5f3075","152c0493178cf6b4404f105673ebfb1205dcd47946cf0dc7bed8ccf29e922fd8","d52611af45c7ef524ab63e970b046a1061f8173af77bce3332bb854291964d99","04789af0aae7a52bbc7d5e129e675a1c89df82999aa606ccdd23b89f718c4ff3"]

Anchored

2026-10-16

Public log entry

search.sigstore.dev, log index 3273084324 · entry 108e9186e8c5677a4edd…

Expected log hash

52df3e0fd214b96d6c701f5f337408916b7566fa39826e2404f759c290be1eab The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1792120358245","kind":"published-quote","locale":"en","page":"brand:uairango","quote":"Very unstable app.","rating":1,"review_date":"2026-05-01","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.uairango","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (4591ccf5fcdb…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.