Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Why do I need a downloadable app for a web-based solution?”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
37e5ac02029ef6b47b22ecb39f82202f6e1cd951ebd2ffecaa2c357e47536009
Signature (Ed25519, base64)
VUyl1an1TypapanX692sdALepgw8Q6iu8PYMAP8gqIuwIfQUwQo1hsGkLBVGJWSdNj2X33LEYUZLGl3zZGRtCQ==
Merkle root
a249ea91ed6d494b0d321c9d53d89a7bb9616ff6f558eb56f9ac9b7e3eba088a
Merkle path
["37ebe4fc077d66f675ed9dddd812c182e4cf044da40fd64f4e284a4cafe243c9","88847940021618fc2cb0c9911636e115d01cf79004322947bb3217450238ba22","ee0b9380dcda5acd61e155e8511f1f289f431ea9b3954673ace72733023ac77c","f61bc703697bb0706a54aada1b5370b949d976a20de68d12a8739ba06538f485","d079231f9bd5f3db7ee71bea623ca47c153000927ed78f0d13c0952cfc62aa00","7f0ff8082f5bfb99e9cce7b7432378c6d094afe4e3fb85acba175d547397d6b7","fd0b16c5f035409b2a7de0b15425845ca4371dde27542ea45aa4ec65f2181474","96e552b452accef57a2ac60da0fad04defeec06e49cb7ebc93ccdc58b5203d97","57c6923be204dc29241b0ee351771d1eb3a0be4f72ae22a10cc47e4b239a0c7f","26e0ee87ed3995bc2f24e31873d6504c0fcb06c7d3e7343bf2381676689c7c63","1c5a7f1ee189f14639069a59ddface9f41e047aca33ae04ea45549360036df24","7b58ace4b9def0c31f126e949991b4fbd8aab642ac80cd877fa3867a5ba96e9f","a13caf334f924b3a1f76b72f847967ab0da2b3b22dcd88cf3e85ba1b401a1870","c5153a29de53059fcdf4e9999712d92e644add9ca8c65cc5e8b2550b7edfa09c","281950cb809ebe3e75d0ee6e38a13b1a88e711d70d03b47950c14223d365015b"]
Anchored
2026-10-05
Public log entry
search.sigstore.dev, log index 3096409536 · entry 108e9186e8c5677ab1e1…
Expected log hash
f1740c5ce7036e4f36513fb4ccb4f6bf95b5dc879a1fb8a1f0778ef42370576f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791238940340","kind":"published-quote","locale":"de","page":"brand:drawboard","quote":"Why do I need a downloadable app for a web-based solution?","rating":1,"review_date":"2026-08-10","source":"Apple App Store","source_url":"https://apps.apple.com/au/app/id1086503728?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (a249ea91ed6d…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.