Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Confuso, não tem como fazer o Pix com a chave Pix do app”
Google Play · 1/5 · 2026-07-07

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3162173160

Proof data

Record hash (SHA-256): 697fd46a428ae28b23244e2cab66a01f6dfcca84bc52c2437904eb1b10875b76
Signature (Ed25519, base64): 60edJuNrPM98ILQ0gRe2Z3oTJW6dCNB0XWWLEa1xAj8Ml48owoy0/fQFSkFePc9UP7ZnAcuoN41OWyGkTC+XCQ==
Merkle root: 47aef0bbc5d347d2f064428fd7eda9e99f7cea2d49004267bc87db0e45c42023
Merkle path: ["697de7892300fda4e70b6ba5844c84c271fc034a3d69d3333211ba135e05a433","1bc24241ef9b5cac828a9eef951631d1acf5740d6ef4e1d0fd54805578d6e025","5b0f10e2386b53258472b43f437d86e0ab9c4ff0e68a047ab5631da8aa1479f1","c67007a6e2ea5bb90b1359c32deff5a4b704b9ca11376201e334174b77463e9e","b05e0975d3d55580ca190639e9d86b55fbbd51c12b8f8c69f2ca96f88a331336","f5d6655c218f065d171629a20d33fb35ee60b2f8a3a639b1ddcc3259d0e7edac","1413780f45a494beccdc239c2edda6122bc9df0e29de5fea2f51b8ba3b9c65c2","afb381e8eafdb69130e6f4eac1c861cce6ffc29742d6a7a8e3ab142853c2903a","798f332994abdf7965a4489a589678ff982515b979a5a2ab63e11e8f44624d76","abb0704ae0697970e97027ccd717bfd36404829c0ebd229463a422ec29e83280","e515e0c488ee122934d181a3d75ff9ba6579ec532e2efec772feef1d496f926b","fc59a99ecd8e45f7a4edce8bb3645315ffa61f5b16e71389405bf26368007a16","b965f789d81d31108e28cb7456c86198eef687ef99496f7aa54fa323ddf26edb","0889ae3150c7685b34e529b715a23984c1ad15ae15f158815b083df85c4c26d0","681b858a978b3dea64df3700a937a058d6290a8e519185bef8ee7388d7739dda"]
Anchored: 2026-10-09
Public log entry: search.sigstore.dev, log index 3162173160 · entry 108e9186e8c5677aaa5c…
Expected log hash: 00d82a97e8d5da8f3bb4a78d598390d6b030eb8338f0e0735ffde6aa5047ae68 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791539060014","kind":"published-quote","locale":"pt","page":"brand:uairango","quote":"Confuso, não tem como fazer o Pix com a chave Pix do app","rating":1,"review_date":"2026-07-07","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.uairango","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (47aef0bbc5d3…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.