Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I've been waiting for three days and it still doesn't work.”
Google Play · 4/5 · 2024-11-11

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2515282333

Proof data

Record hash (SHA-256): 3a64e0514309846479b5ad323204ac2657276e80d8f1a87fb4c999c836619c56
Signature (Ed25519, base64): T8qCSbfXpbWH+Et9B0KoIdlQoVySCYZqlV5ZArAwrlz5lv/HIJ8AbGR/fQ+pBAAsMI6s4i72ryCtrvfbaj1OAw==
Merkle root: ccae92ceb3dcfba104788424188fa34a8cb1410075ff6c1a21fa513e89f0c4fe
Merkle path: ["3a675ecd2f5928c9801fbcf20cffa0901efb3e7ceaabe7249830c60033204842","0c6ec5ae4bf50e259b1c1cfe4455e208b08d0b7033ca2736f747891df88e3a3c","7fad1739341220fbb5e8a89975f36611480568e5e4108a006c83f11d6d2f3dc5","f104e5748621408d0104e307c9c2d9b56d0ce5cde98c1c381563c2abde7390ac","fb587b901979362c86a8eabe9c8637becddbebe4238b27ebe5a29579aba6e1fc","1386635a11a2665a20f9cf4fb35443118d68078fb7b87ed1af8fb343b9e67da5","d836fb6b373abfadf2877f223a60b96621746eb1ac7f7b3050f8f9848d442a79","b69edf43ec2457acfcffadb3d47e44e0cd1e8af97fb3bed9c589103b56bab752","80dfcb437c1c580fa830e5dd0301bf520d852346e39c98bbea73449ec88a4875","b29122d168d4b7148dc9a6d00c87c1f2d16b1d432f2b52ae17eb8a319bdd2bf3","58a2c7885cd95f735a22d037f04716195fcb88dc97c3004c9bf1293cb63f1502","99697468961eaaa4b5797561798cc5ffa2ab8acd44a284d775f26b440d075f5b","f7990b6d58a0125e363e1c2ccaf33e30b0b4839c002a218db24fff9488bf159e","818afa9b60a40d27c2e88a8e5f62585c079335588148aef8eef246906a1d9ee6","f73291c2ca924ce4b3764e4b6ff1da65a701069f04fad47c52c8b693a0ec7e41"]
Anchored: 2026-08-19
Public log entry: search.sigstore.dev, log index 2515282333 · entry 108e9186e8c5677a6652…
Expected log hash: af455e73500113c158c8df9793eab703ff863c9c98fe38560752c9a1772810a8 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1787139531268","kind":"published-quote","locale":"en","page":"theme:relai/delivery/en","quote":"I've been waiting for three days and it still doesn't work.","rating":4,"review_date":"2024-11-11","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.relai","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (ccae92ceb3dc…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.