Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“So far so good!”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
60a1c8732c56118dd59a9fc74f0e35c00925a6a606a191a03ace1ffa8bc58ebb
Signature (Ed25519, base64)
i/9CmQwhEiUyuuxhiXkzoFp9gGP5G43fm3B6H4Ep+JpxhzhqmktOUUL6YCUP7B4aX5ikufbLD94Ge0vhGCetDA==
Merkle root
52d6be1abed15ebd0724a0e1a493d5805e1ea49ddcaf8e9e5584928cd3e4d759
Merkle path
["60ab665b8ed422987bd3932de2c71b9bf7b63f9175809894b6bbd8df7a58016e","f5dd97b4f85ae807aa8c314e565119932dd737ced26a66284597ddf4fd4846b9","0a1151ef5b31d3333988d46756f02667e104f62293bfca98b9c7abb26b723447","04c927786528398fa2467515507e9cb59a5484b480973d0480304eedc2b389c9","fc2de6f5ccf36dd21890d2f4c7091e5b01bdba975d1c4cd85881b39f4a8df008","0c58683125dad820f4b1ab1c73644779b0138b58de5f221d936c1887f318e546","af2e4ef16ecf0497e59c4eced188d514fcf3c1fe9351092c29c82ca25293408c","66274e36ab95da14566eafad1465436e01d090f1aafe03e3af1785f2b8bd7fce","5f1a7d7b552611fadfbc198c33f327b269bd06482566f00df897d670d06f666d","6e58f7f1a65eb6881d756a587a63cfed9ffe2140971bb291d2dbef7c76bc6c5e","a001fe848713bbaeac6931576b3483542d028bc2e10c577831e6728e16573089","53111e7ef7dace69676af73ccb5f9205e4d3c8a75638b211f97f1508c9f49ed6","7bcd5a7947a92a6dd94070d36a9ba6ee3547a773e1a98d6a8e599913acec3ca4","71d5ef7f970539b9a82546e0bdc1b1069245bf71351875f786a78e5550da4e15","b72fcc24171828b3fdfff6be65bb433d37b8e51a187739d27a216a784d84cf36"]
Anchored
2026-10-08
Public log entry
search.sigstore.dev, log index 3140475820 · entry 108e9186e8c5677a78c2…
Expected log hash
bb68bef30792bf00f645df162a48943f770bc3f026216a44dedb4651c8ac0917 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791431489246","kind":"published-quote","locale":"en","page":"brand:wave","quote":"So far so good!","rating":5,"review_date":"2024-12-06","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.waveapps.sales","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (52d6be1abed1…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.