Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“app doesnt seem to fetch mail”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
4ed79d0fe64d690c7a85ab9a781149bea9692f35399e2712405cad2ae2097198
Signature (Ed25519, base64)
dZsZ6upy9ja1U/teREvxBhzNdHJq+yJ03DMWlQZrEb4iHKhZU3UTfIu60VbXa082eRAFvgxjaVb6eX1nwwL8DA==
Merkle root
afb9ffbb4b4e88017e1c868247f919ebcfe69f09127d391e7daa08019eb2b63b
Merkle path
["4ed83b5e200d20bb4958f77ada92b24a21d95ac1f4e2bf256c4e917bd32a60ca","f182f1cb333900c984d9bd1a711e723f6d066af54fbb6edf06e1295cd805fc79","b92f1511908ca960871de9bc4acda81840e07e4846aa8c53540967c2f3a07178","8e173e7d9eb00ecee8111173a76825fc82af59b2e20c159be078dc6804c1485f","cb837281d9f8a2d05ec3b020daeab612f756905e47f1cd3851a729efcffccb9e","6cad14c03f21317a1eb882c4efc88937e0f3aeeb938b483292a48c4ca8e8518c","7ee485b5c9fb5f27ec7d4f4c2a07fde2163f176b3bbf3003a4fe7e4fa4268323","cf719615642543f405ea6999af156ed80c1c260616731038a469243f0bf50cd1","e31fab619b66eabb90ae03508a4d688192d3733c3a14c6e35316725bd2691e77","b678297ac270093814be0b9d15bdc258e4248eb5b951fa7d77b898f7b654bd23","dda243dd061ab6dba48f54033ab5da95d0f031ca4b145e0a3ae4adf84b4747e2","ed12f30047dd4c3669ec0c51ddd1fe0336b8b598549b0f1447b25501a6c42fa5","cfc6855eeb5cd3bfbc64cd1a8365b676fdd5adf536ee2637beb35214ad734bd3","15ecb20ce6559654c94b8b858c027c014996a92eb19771813db0b794d6214fb6","72bbc4ee0a973113b1d556f76d02fea2c4704794a0d313a96e49ff7b6174dec2"]
Anchored
2026-10-10
Public log entry
search.sigstore.dev, log index 3178115911 · entry 108e9186e8c5677a2bba…
Expected log hash
a144ffc32dfaa9fe45b4895b7f4c17280667152868dd8de227ca2811c60c870f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791604579182","kind":"published-quote","locale":"en","page":"brand:fastmail","quote":"app doesnt seem to fetch mail","rating":2,"review_date":"2026-07-26","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.fastmail.app","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (afb9ffbb4b4e…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.