Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Very poor app experience.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
3b35eab225d99c452128f6cc3e5a01aa9b09ee0c0097f36b064962130c2028fc
Signature (Ed25519, base64)
fg4fCKQtdyuq0R51faL0NzyCXT5z0KF6GfKcMEvyGaEuIEufGiQf6jNCmfzQVklOvU3UcARM3+4ff3nl7IeMDA==
Merkle root
fefd76293e002e3e9b1a8c28dd2b21a6a31f7840085e07fed39fb8f3e1a027e1
Merkle path
["3b354cfb193e5583aa9f41f1b847bbcbf9e5b43ca551c43b9c6557daf4e1bcfa","f601553baa36654cc1619f865af32241eaf706b5d1ed66189e3f1319fc2f2081","de63cb4349b7d99c8db0a94904e434a3c4e27ebbc4b59a288a0fb210307fec8a","0f95ad0b946cc221908cff4bb9779d9a54ff23fc704380734c4f348487234c0a","ff55642e3e4b0f54f6f95630eafe94f5ec613663cdf9189a9b64e637d23f12f4","4696f2a9113cd4b8881f0c8d0e6d46c27b88911a73df9044bfd1de9356de6d48","95d66aa53e308445d30b12eed37d57f583d515e021868dce07cbee2cf0e8934f","65d7de16fde63418aa9bdb0c2a481b8945d476922406820ab730f24c9082f25f","807ec7937b69aff4f36e2da4000a5c8a2ec448e37ee80b7cbe91e582be9d5de3","a4f50381283bd057669b1eb349a7879dfedf9144881bb51c04fac69f47e06d18","cfbe708d2913195e421a0d737ff5e663a37faaa3c07ee5efe84a6cec6f36d2c9","368d90096d1dad78c0452040310b66a4f78f013c1275a844c65f56ce5c532da7","b33f49013ec35601ade22b53753891ecd57d0d1932d0b012133746ad4927d388","7a42de951be4e00d60ec0bbe464a0e0231a5c4314a65e01d8dbe2db19807a7a6","5bcc0454d959fe45b9d8cceb30d3231d2e09d219fc5bea4ea59efa077a6567f2"]
Anchored
2026-09-02
Public log entry
search.sigstore.dev, log index 2685374445 · entry 108e9186e8c5677ad2a6…
Expected log hash
8052ff4797a042637f5e0b94324bcfdc656477714cef5f2a8f0c16d93147fe68 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1788351002274","kind":"published-quote","locale":"de","page":"brand:teamtailor","quote":"Very poor app experience.","rating":2,"review_date":"2026-02-01","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.teamtailor.app","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (fefd76293e00…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.