Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Bonne Assurance”
Google Play · 5/5 · 2025-01-18

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3666748782

Proof data

Record hash (SHA-256): 50383e2813a28c3e05c4195309d00bd276ec4bd9850e8b0c1b5a335c3cc5b444
Signature (Ed25519, base64): zHGYNyYRweNj2uGGUPPnkYyrY7r/GC+xF4xgF87+BUCh6YgCC+OYOzG7PbbYGCDCgY7ldLHUQjNB6LPedM5gDw==
Merkle root: 9f3bf01edb9d597e26c01d8c9281f8ebd9083c8348fa27bf99e2d3d27a8b9c8c
Merkle path: ["503aab89143062718170521b7a9fb21a0049d737ac118e5b1d52a6ce84fab09f","162010dea0eaf01eab2ff0f125d266b57276fd5235545b9f586d6ecf94076d75","d68dbe365c731a1bd1a0c5b99fe93bd9457c9faf406074ce454cdf1d5a34d8c3","463d46f22ec02d505d5724d7c37956bc384efc6e91abb0766dbb46e9af8aa144","12bfbfab70d3e21caa4b2cbe7c21874586d0fc3f653926eb0bed787e7917966b","1ca4ceabf0a5f2ce1656c6cb2c5459e88a5180959e26cc4b1e6ae7e139a0069c","a7ee2bef3a3f451be3ed63ee1d39c92d6f68be607b529287979348cc7db31824","cf6c6d7cc4574de246adf62157d69285092c13f790921510f7f51b83388aa5b8","3b909ad2626b725c4c22879918375f5b3acc9aec87ef0f3f2935022ae54797f7","ed18319fc0a4ea0dd2a4a1fc1a7d13ec2a87931ca244f6b0a956c72edf09eae2","6f7a68fca1bb93c516f461cc3d6b3a8daf768601a5d19987c6a0b82bc32dc09a","4332b2fae13a0202cadefb48ceac1f7e0148657bb8e80e178aa26837cf936fe7","ccd3f6a502c459e3bafdbecf5a4380782b0a6666d918776f3c595a5cb05f3e9d"]
Anchored: 2026-11-03
Public log entry: search.sigstore.dev, log index 3666748782 · entry 108e9186e8c5677aefa5…
Expected log hash: 5b49e28274358602b99f52ab121ad302428fe63b23ca19ecf9d795208846c99b The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1793702050700","kind":"published-quote","locale":"fr","page":"brand:atupri","quote":"Bonne Assurance","rating":5,"review_date":"2025-01-18","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.atupri.myatupri","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (9f3bf01edb9d…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.