Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Android not so much.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
4bddc19b9ad523c7b2e27b57856af2e5e0ab50f969247898926f02bd146fd2d9
Signature (Ed25519, base64)
glJQTYgdShhhBPRZ/LmfhIGz5ncbvN+EGnDvk7iITHsbHGEQyVqpJFeRmo/snUnd+JVmL1cHiZ+MVsNo7OYsCg==
Merkle root
c5671f9a997da9b293a79ebe58b20e4534ae608121169f15a5adc358d42ed147
Merkle path
["4be0cc060a0c9e03b87b4d04bd17a65f765e39bf03606b95f7177a0f28c4e8ff","cd41fa78bb4a54a66b908bb05d231072be356ef90d0ff1a9d595dee35ec06e94","ff0617f32b1fcd63ad022f27a74764fd6e49feed33af3b9e4b503328f3a43b53","c9e2603f0d168583b3a2d1f36796753a5dd233e70f8b0df9543baa636d539739","080f7784dac7f10f6366e022905613a9771f11d5f27e0b77637465d8777ea1f5","8a45eb2fd36d361c947dedfe76260db3a455aadb137aee3c06deff14ca62e283","0f1b5a8a3daeeb4ca03453767fde768a01839f0ada017bc7ad8c439fbe8047c6","154ad4d945330089ea705881fe999e6592ffffd10c8a40e1c8695e471476d988","e52a5d45dab8ae95d7a5193289765e96eae7945d1a947bfcdfe698cdde36d6d6","4cea41674252b94d8b12cb41abb2f4174903d97d8943d4254159249cdc47d17e","0a1a0a7d19cfbbb4f6bc601834c5681473128094ebf48bc90583275cf41058da","f65bea56724bd08a8afc3852cfd8a3041e22c6b5f39696bca2e766b33a5aa93c","e63aa30e4323dcedc3b98056115c043eae8c9318933e7df53c20936400d7fca5","a2027fad4413a16051db12df072fc2064ab8e50a759412f73c3932ba08f51b55","064efe6476d8e8bd839601b3c80763b02793c41f87cba57580faab7c00dda24f"]
Anchored
2026-10-05
Public log entry
search.sigstore.dev, log index 3081733041 · entry 108e9186e8c5677a0bbb…
Expected log hash
88ab7ac46d4614551fa6e665889f054d7592b15d91016a45621b5c46a7ae8e2f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791174108170","kind":"published-quote","locale":"en","page":"theme:roboform/delivery/en","quote":"Android not so much.","rating":4,"review_date":"2026-05-28","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.siber.roboform","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c5671f9a997d…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.