Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“DO NOT DOWNLOAD & USE THIS APP.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
34df75867d9f9a236181c49464812bd69a2cff2e76eb2a2ae8cc6e6a9a577bff
Signature (Ed25519, base64)
T+gbCzP1lZU1VZ6Kk+6IlDzlv29qLEjvhwY38t0o2lzSZL419LQjAQhygvylc1ruGiH1I3xvne+ydv0w3Q5AAg==
Merkle root
e6ac019704b226508e994cc0855a4d192d5ca56f36bf79e20dc9e3368a99cf1c
Merkle path
["34e1385bf0fd4d1b35c8ca57c71ee357283a77f0b1a6cba605ae49f4cbbedc31","15b163d586641fa14b26296c26724ef2c7fb199af01ec0b5ff203f058fa7f3f6","4d6ccb7a53e3f6a11b98c269d8288f5095a8c811327f848e9c7fd82331dd6b28","ca6fe8019506dd6d11d530b6a0d751213a5307c433ef0a3f597fd693522d55dd","29b8d9033bcc5a6900b8b5d7028c6891e90cddc9244eda0359086c60129f3ebe","044521268c07530cf87dc2bc4646c18b9d6f69543096dd45a50af91b5dbf3bb8","d0c5f02fa73797ecc2ac4bff4c9acecc364a8f39828b3a021c9b54e36e8f49ff","9cf94096d42001028578d2f4e1bc9bf8a0d3bc14f112b825cbe36234f8fe819c","e6b5e0309d1c62c94acc2928858d11c2e907372a49ad58b83acd22442e6235c7","497babe63c11e4fc0154a4c4545a5b071387ac573672dda1ba1885217b3fcc7f","b5c32ee5dc3d3e7f46ade1921a47c7b4e8a3d6e9c2d05481d24eb3c97fbad285","34cf0a4c736d1fe831861780b0a960a206a4635794e0e9b8826f3233c55b1efb","6607742043dd5e4f5ff4cde1fc26a938e3b873d3f1925aa6b85feed605673817","300daef4aa548e8c10fcf4706d8cd6c134a74d44a2fedd09c528770268883f87","55037d90ebc6f8ee5750b678c0269386792b0a1b293edb3e029a7c8e378291ff"]
Anchored
2026-08-29
Public log entry
search.sigstore.dev, log index 2631716425 · entry 108e9186e8c5677a0f4e…
Expected log hash
45ebfa784ea01d364c463997b417af34e35327c4187ff9e9782aece8c325deea The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787968874252","kind":"published-quote","locale":"de","page":"brand:tomorrowio","quote":"DO NOT DOWNLOAD & USE THIS APP.","rating":1,"review_date":"2026-06-26","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=co.climacell.climacell","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (e6ac019704b2…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.