Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Don't install it ⚠️”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
5a3bc620abcaef2424368556b67b7b71bd5c84b69f1ee8f2b555fd793fc91d09
Signature (Ed25519, base64)
WWz6f4TdpptzvVvGKcKepTVfFKq0EuijdxWV+gAWgDJ0uJofhM83Am+IXZqb5atRIiaM6uUjK4XiMnvO8rCzDQ==
Merkle root
c5671f9a997da9b293a79ebe58b20e4534ae608121169f15a5adc358d42ed147
Merkle path
["5a3a690096400c17b0d6597ccdc0405f3b20c2037294d278e7f170e3d227b662","ade69e50717a421001f19cc11ac35b5231d5b5a852ef1ff560b27efbafce8b66","44fb504df46acf8f2824fb95ef246513b3b545066d16c3856e86295b6d647cb0","067d27c93b91eef574dc6e2d09bab8176315a7bcf42a603026f8457666c25956","2409206812d9b3b80b852474bf88197f7ee2b86bf64856f1b5f1cab58f39b7b4","d27411b7afd1dea6863e6745cb4453e3b7322af54d14ed10b96eb6f539fe0804","9af06f4a8253738580ecbb6c19435713a23721d61b855302841a8776b34e5ce3","93c690a04903813e5476fe3094547daf8d076dc4fefac07ff9ec243c3b8cf84e","1b2a429d4ea95ff0fda4207788cf258ed8732bcde1324bc95529182b22e70b8e","8a4a643cd68c21c2702c88cc37510d84c60822b7b09162b27d89cb5f08991fd0","727aa3c2e173b3f6b3c9c9cec58e11154a9dc2afe30b329995067271207cb43b","e95661d918d51f5a2b9a00d6b93156d59eba6aef774c7d758af0695371173945","e63aa30e4323dcedc3b98056115c043eae8c9318933e7df53c20936400d7fca5","a2027fad4413a16051db12df072fc2064ab8e50a759412f73c3932ba08f51b55","064efe6476d8e8bd839601b3c80763b02793c41f87cba57580faab7c00dda24f"]
Anchored
2026-10-05
Public log entry
search.sigstore.dev, log index 3081733041 · entry 108e9186e8c5677a0bbb…
Expected log hash
88ab7ac46d4614551fa6e665889f054d7592b15d91016a45621b5c46a7ae8e2f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791174108170","kind":"published-quote","locale":"en","page":"theme:everand/communication/en","quote":"Don't install it ⚠️","rating":1,"review_date":"2026-06-13","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.scribd.app.reader0","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c5671f9a997d…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.