Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Diese App geht bei Android 16 nicht”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2632728886

Proof data

Record hash (SHA-256)

30508e4bbefb91d7f0bb67bcd3d257f13b123ae92cf2deb76210f0a2a047a155

Signature (Ed25519, base64)

Vf8c1CJ4hy+Rw1Llw1Xt72H3Y3vmauLhSq5wAQ6bbbfVIrciJG8ZWcRbODNtZscE+tlo3WV5mLeXIxfHkMMmAg==

Merkle root

0ba1b80ff2165a62bc9f9f25c7b671d32a81a8e4f351546efb788e090f369376

Merkle path

["305adfe9016adc7949629c7174074ae8d2ce4e96f32b9097e865f5d7059dedc5","bccc4b66bd4ab513d685843857807f4429bd05464d6b4df31770a45e53c6446c","8281e6e6a0247ac04cfd4b4f4067fbf3d2e598961c01ba263b45668baeb0e7c6","42f25a4aeb877b94d8f0431f79645205adbec60df5341d01c11b1f564bd95f5e","76c456a1f02393c7090e6c4260a18d7dace0bcd5d5c4697139fc4551adbed9cc","e77464b0bd988b4a46fa17b0427c5f35633aff18b38827863ff0aa3f3225e1dd","6529280eabf7d6c278d195d75ad028ae781d6d29edde81df5c51d84e76cf6537","3aa7cee616c477f6d2b76f26e9650337aa0fb392ae1c083454c14db7dcf31a99","01c3d6862db8fba15fe0fb798b6e5ce2b275a01900b30bc5cec11d8534ff2343","e6a0fb839352976a42e990322a36e65858c30e4c4669a6a0ced0f7bc9cc7cb29","1c387726dc9400bd934eb79803c02a6138992f4e0ce57c390a1a4d5468c48fa5","cf0334768c6f832339bd553a1065d1380e10ede9a65c50aaf9be94c6e9440713","c1b1b5496b6914c6c45a9efd031bd58b7dae0f454060b68961a2586c70ab4810","e3bdd9cd4a46c1886472a1771a5799292b1c8a1505c3320e374180146177f347","9c07fc5299395e9629e50b7f7f3c0b3bd92e7116744c8ce6fa87db9d24fdb3b0"]

Anchored

2026-08-29

Public log entry

search.sigstore.dev, log index 2632728886 · entry 108e9186e8c5677a444c…

Expected log hash

ba382b40bcccfd5823af39360159e6e4433d6ffa61f32bd2b6c045e496d9f4ba The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1787975494243","kind":"published-quote","locale":"de","page":"brand:worldline","quote":"Diese App geht bei Android 16 nicht","rating":1,"review_date":"2026-04-21","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=eu.softpos.softposwrapper.wl","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (0ba1b80ff216…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.