Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“the app forgot the accounts”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
5c94993212c831162a94d031a180305f347abefaca4460a6eee3a40bd5abbc5a
Signature (Ed25519, base64)
Uu7ZOCiWN+YYYAWXytFp1/b9Cw9QdmTcFAJRdSWc1MjD202qjqmjkx+CvuCS+WpM1mRnywCi61tOjhwt155dBA==
Merkle root
ffbc979c8901fdf55f43c5151768b18a738fc1c271c9b2dc97349c3fa8ed35d2
Merkle path
["5c912765dfcb4fffc897ceb334cfa8198e3d755082360246f3d6d16a9f5980a0","5595b1a7da738fce36a0c41f3b1cab10263c6c9f3535df920c905ee3704e32c3","60f32e4b631bee4985c3fd3b7dd88eff5a43f5e20b58a5382131b11e8ab42d87","bcd724beee4cff00e6f007021e94346f23cfb925b6ba0197e6e6e7bb5de6ded3","5b35782109bec101c839bca09a1cecbb102efaf4feb508dcba4f40714221d185","3e8e737379dc095784b974caebc6a8ae2ecdd324e19f24fc6ec5dc92fd5d27d5","2fe496246a26e259a0ba28464fcdb56b10af878e5dd91c887313f96ba0b219d8","a7bb80bfc1ae7c7534b6acf5c45279899502f3aa2cb7dc114e4f5835a262867b","5d4094b13430ce32cf726fc4c9fd741bd182e6edcb6c996fc98c51ea77b708b6","6c529f58bf845b54e47e76b935ed59820268aaab462812f64407ad411d88ead8","bf4520be0c0a25ff7fbdaba93f610644649eda79fd99e22008a4e6f0fefee1bd","45fc2238455aa65e3b4c8344b94c4c6c999df482a430c903a8e0496e105cabba","fbdeba35a2e566aa48ec8885bea50296aae01205515c3657aa205e182ee9d5ff","2f35432083547a52411b4b8128ab118601abc6a6e158a38894add0923255dc0e"]
Anchored
2026-10-11
Public log entry
search.sigstore.dev, log index 3199173952 · entry 108e9186e8c5677a85d2…
Expected log hash
3bc66074c7b0a853326bf5ba0590a111eee6455dac5c98c791c22eeea9a48920 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791689192448","kind":"published-quote","locale":"en","page":"theme:bitwarden/durability/en","quote":"the app forgot the accounts","rating":2,"review_date":"2026-07-05","source":"Apple App Store","source_url":"https://apps.apple.com/se/app/id1137397744?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (ffbc979c8901…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.