Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Every time there’s an update, I have to login and/or reinstall the app.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2671180029

Proof data

Record hash (SHA-256)

38b6813233f1d773cc8afcb2ac301252efd515fb425bb0afd2846fa3d24577ac

Signature (Ed25519, base64)

wbN1A2Rr2sftykOoTxCcEPT5MOpy/0I87eyThY43dUreLOs/Wn4JB87tJBYN3Brn9D1uFNw1+/z5IyXXyqGdDw==

Merkle root

f9a030a573da3b674a3e48c677288390a434ca97a740d63af7477bb9b0087dd5

Merkle path

["38ac90bf37467cfeaa7a12bdab61f1642834bd23e3f8d052876bb6dea2aa8ba2","5f190d4a3682ba472c193979e09101b231c99dac430723b35c91ba82816bf676","925e85f15a4ce8d2fa69b8c4f387bf81eec66cae42989f0b81215244a9a5f65c","140bc8fd3a03d3faa183e212608914f91e2b811581da5fa1c4502876fd876b20","89c2142034b3783f19aeb8914fe769340d7fdc66ef0b54b42ca634a4a7364c74","3d64c5df359a5023173735a7129458584c3bc14a897112771b88df610bea7878","fd42cf0d55e2369e328f1d618ab07dd75aa6809698ffa0f6894d3021e1e0dd43","1844cf68247f6f83dd19ae311ec90fae0b867fc6a4492ae64a7bae71d66632c0","f319983b468e1add139a111926c831c70b75e3d858c211e8f23637f7d2bc032f","1cdb407aa1d9a4ece8927668543b67b824ff3b5a2e679b75cb4ab48ea41dae43","188ada523c58c8c5c5a47d0c8a6e5ecad7176d570a3986d4ec6d4e0569eecc8f","a380761718bdcd8707209e07c5f70d98f3d8e526e44503deb09be257f75349dc","0379c7a238f4a741366a6fd9a03d1e5f9bb89aa148b07e3f738ac116d1c41584","123f459bb0d221b9be08e494016e3b59946d910cadbe6bacd03f308db88ffcd7","e08301f62b5ff22d13e806e4fd3e64913f665178fce99d41471461eca04be078"]

Anchored

2026-09-01

Public log entry

search.sigstore.dev, log index 2671180029 · entry 108e9186e8c5677a15e7…

Expected log hash

0c7ea517d47f4c8d05e0565112b0ba6c031576195cb596b9212fca396bc97897 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1788233488301","kind":"published-quote","locale":"en","page":"brand:swisscom","quote":"Every time there’s an update, I have to login and/or reinstall the app.","rating":1,"review_date":"2026-05-08","source":"Apple App Store","source_url":"https://apps.apple.com/ch/app/id798597407?see-all=reviews","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (f9a030a573da…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.