Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I'm not receiving an email via the link.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2929513415

Proof data

Record hash (SHA-256)

69db6e9cf0f733e66f85d69739db0fe624010d39bae55604bd8ad01813c834c7

Signature (Ed25519, base64)

7HqF+Vlv/2zgFUhiy+aHdyCSBIdxGHWatwJGiIGyLqHxCEcwEFUenftNHDo5M0qdyzbT0o7VRa7fgG8oUjAyDA==

Merkle root

277f678086a68384187ff29b395b0fdaceb8fee69b57cef3cd060bcd7a85a6f2

Merkle path

["69dd2d2689a9c439e048059cf0c08e2bced816f9a71de4ea3923ba29bcb06f9f","8a6fa740738981754f608ad96b100e05406eeca9a53b3cae3cdefdc20670696a","68d6b6f2dedd16a63b45ac5114776ff4b97cca543d96e397b1bd9dbd8bc6e48c","059781180e6a6634606e04833b1b462e2b580fc7644ebd12b3eb7d98c258801f","e47004b2808f2c4624bf80cfc107aa82b5d10fecc637f7eacdf6b5e1c09af733","75f0e2b4a2ad2a7ed850ce51d83c579c4f032494eb003963d8fb90f7270b4ff8","17e63f8c55f164b61bb1a34fad7f54bd77e3af195c7e1c51e7f9b323f65b8363","25d74c6443623620e2698a66820b873613cb29b97ca6b9bcb76bc086798ae18f","8c8c85d8c462a43c08fbad5ea7c775c5a782f32770735621cfef0332bc1dfcb8","088bab6d496812b7c21217bb15cb1492c0f615f4da7f2d92cc48ae3b2058cc5c","33184179e6410e1d4481a0c98464cf68c91e8de800a9099f0062b37c736d20d3","d6fdaa57e40c81a651fe32e650dbfc00fecab21e8ba71bc260c30dcaf2f68ca4","3a4557370606b510c9a2cb3a2ca3671efcf47160eb4264ac3eb8a4e9a9f5afbb","3877db10b6c6cae54d2b07bf0b4ebaa05236dbdf377db3895f407f63dda42bdc","280ab60d4c161cb719b6156fa9102f006908a25889a024565b61c42f89983a6c"]

Anchored

2026-09-24

Public log entry

search.sigstore.dev, log index 2929513415 · entry 108e9186e8c5677a8264…

Expected log hash

9e91de35fefec2dcd249a303ecf0c84a118a9b2cf5b39f5a9ff4368de67598cd The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1790137911951","kind":"published-quote","locale":"en","page":"product:bitwarden/agentic-ai-security/en","quote":"I'm not receiving an email via the link.","rating":2,"review_date":"2026-06-25","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.x8bit.bitwarden","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (277f678086a6…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.