Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I got my money back.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
4fa62e88422c5eeb37cea983d2f61c981a18d5ddbd029e9dec0d69655f9b2d69
Signature (Ed25519, base64)
88zot+vWZ6Qz85D6xuLt8mUII2fOtBl1e+z8eWV6uUA34lUlsBkGavKUgh711dYNTCqEEUh4azBH4BwTcxZkCQ==
Merkle root
47aef0bbc5d347d2f064428fd7eda9e99f7cea2d49004267bc87db0e45c42023
Merkle path
["4f9cbb86823ed4db5a2a5094c3196df2af5106dc212349c8489e5e28403d9413","f200f4c24197b983ef8a1370f801c9ffbe213f1f8eb05e46648e6c5a218a2c9c","bfdb09ea85a7bedf10b17d7eefcbd94ef1c84d930f16c68ad57dbc169bfddb90","34af6a59cd1239941694f7b7ed5353bfa5f0edcf092df238a4c54413aa91fc63","f8fa5088a0af2768b886185482c0547f8d420b8e7b0b38bc66f954eec4885b5c","0779c93ea6381f95f50cdf0c6b6365eebd111603496ed769d7ca5ad13b7aa987","00e7069754161f1e471710ff1dd3206e2b55a7b57d20bda4d3279fa12b15caaf","3399c05e09ddf5ef2cecb616e73d3e173b73c98c9990d1807fe5e33111fb6581","4ea11dd86fcc8c4ae3f866c5ed8b6b282f99c874d2ce132c1c0e5b8a8f7642fb","55793731d57dde9239485742281f3868c1094bbcdb3b30eccdf67582ba70a4fa","a03b383cbbd48a4814f6adcafc46c55f6c316f5cb65af315d8d50c74964e21c8","8dc73cd160216c8a27b3781282fc4b9db505a9e1e30c18afca51fe701283a379","b965f789d81d31108e28cb7456c86198eef687ef99496f7aa54fa323ddf26edb","0889ae3150c7685b34e529b715a23984c1ad15ae15f158815b083df85c4c26d0","681b858a978b3dea64df3700a937a058d6290a8e519185bef8ee7388d7739dda"]
Anchored
2026-10-09
Public log entry
search.sigstore.dev, log index 3162173160 · entry 108e9186e8c5677aaa5c…
Expected log hash
00d82a97e8d5da8f3bb4a78d598390d6b030eb8338f0e0735ffde6aa5047ae68 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791539060014","kind":"published-quote","locale":"en","page":"theme:taxfix/returns/en","quote":"I got my money back.","rating":1,"review_date":"2026-09-03","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=de.taxfix","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (47aef0bbc5d3…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.