Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“The app doesn’t allow you to add a new password after removing one from an account.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
6a2e91b33b3eec84bc4a7d40369d3e8ef0c4c7a04609535ea29c5f6de7aa51d6
Signature (Ed25519, base64)
S13gw5iFmP9E8DnA9ua4Av1HGuXCwnJNVhO6nZXQmiIQ8Cbx/BnWyRAK1uEKBZ9rWrXmlSk5pc8TuFTCaXDUAg==
Merkle root
a249ea91ed6d494b0d321c9d53d89a7bb9616ff6f558eb56f9ac9b7e3eba088a
Merkle path
["6a2ae349cf461b9f74496124469e80ba9f7f0b4a63b1347985e7c278640d4a2b","c96cb47e0c0d1504f4c92eadba66a279191e1f0ea65c5d128719aaae9389f078","1fb47b1ead724185d392e63f9047773172026047a08ef47babb9c5b84d548c1d","aac2707df17cc44e64480a787a2eec341b0ed867c015e56b46024c7db3bc74b3","9a6324a89dedf7df29c1857d4dea01dc8a69178f7ed7215b16a60f8208906b2f","668b00320f0fb7e57e0dfe7e8fa3baefdf92f01e99461bec25b4c48a072e443c","0f43e1c4ca9f8c316d9455427e8573970f63546e3e2182b26472b0d64c661169","e8ee9f071345c5c9f279947e237676eaacfb488016ba90cf784b3b872dcd0156","a2c05d2d6116ea3059c332faef64d876b70e596ed3ec6bb6837a9035e1312bdc","caa26761335345a2d684907b1c5b770870caf85879468bac5566d1f224be5ef3","45a64f680cd071f77e526d2a2898312625ffec9ce0896bf3716d545c3b5057ae","605f5416bd8b8c0bbc336c1a973a51fa8a6b93bc921e933bc3071f472da45130","d5e021977b34ad36b21da49b9927d272b0276f8c83a56fc552b6acecbe7e3ee5","754b3941f2d50a8472bcc5169721f8ff0fbf11f5f5f132a78bcf17e8d3758eea","281950cb809ebe3e75d0ee6e38a13b1a88e711d70d03b47950c14223d365015b"]
Anchored
2026-10-05
Public log entry
search.sigstore.dev, log index 3096409536 · entry 108e9186e8c5677ab1e1…
Expected log hash
f1740c5ce7036e4f36513fb4ccb4f6bf95b5dc879a1fb8a1f0778ef42370576f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791238940340","kind":"published-quote","locale":"en","page":"theme:roboform/ordering/en","quote":"The app doesn’t allow you to add a new password after removing one from an account.","rating":4,"review_date":"2026-07-24","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id331787573?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (a249ea91ed6d…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.