Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I cannot add a new login unless I'm connected to the Internet”
Google Play · 4/5 · 2026-07-19

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3123908662

Proof data

Record hash (SHA-256): 6bda05a8ec61cc441e47a3d8addd7e38df9c2d1cae73e1277d4c1cf9906658b1
Signature (Ed25519, base64): GuzqmF+iEXalP2mBLrIEhj1pvnDrk1I1EDm1Wp3wepKZNbp7dYRxZih1Ft3Z1HNe8eZzWYtd7c6ZhaZxjiGRBw==
Merkle root: c53673589b1f41937342019e079ee2c0ad1635342b5b2a41cc71894367084fa3
Merkle path: ["6bda62f32e993782d040575b52037a452c9c13f4165109c97e98b9eabe1877a2","103821938a1c9873f4964769dde47f186d49847592f4f51fc9926f8dca62bc88","97fa3b6d86cd9b3a09f6ceab1029ca5aba27c9856996047eb2e524861418787c","636c48bcd0363129efa40ce5c071ad9ba7b52dcf36af270ef28e25b981e784ea","f51342a32a48594850f3b2ca066946dfa90e0cfe0c6adda8c5a027edf840ff38","60c6ec0557407ac7d8d20e7e5edd845bf45160008a9f990234dd9a23457a549e","f52a6214fdedf613d71a3a5ee3cbc9250d39ddace62aa959204199fb860130e7","d78de596e8556fef580d0619b36cda58204ebb05ee1c172a33330cd5662407ea","8a076403ead3c33df7ddd968bca3c3253975373c0d73e7a54273dca2c440f10c","ec059c3a3593b0ce19712f70d1b5358ff3c271015cd9682ae154758f51f7e53b","f0b56a59a44ea7850b1490b75351e04ce1959909cc8f1e7ff5f35b49e1d3a748","e6975bdb680ca61589e2adaf9fb8c5751c7c5d7faae2f5aebb9acd92eb2c43c0","fe401194a89b1a35c403a838c20d5686b9ad58181ce3567976f2ac8fa6a2f5af","4cd1a38cdfbd42b170e4929f839c7168ae4c49380e77ff0b1b146fb7e3e194bf","8308334b0715cdc2685afc133c95aa85c9b86c8dab9c8659092b74cf2783feda"]
Anchored: 2026-10-07
Public log entry: search.sigstore.dev, log index 3123908662 · entry 108e9186e8c5677a51cf…
Expected log hash: 5372e71f27172d067b5d688f48846b5317672647da39397abf474cf22aba0576 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791348381030","kind":"published-quote","locale":"en","page":"theme:bitwarden/communication/en","quote":"I cannot add a new login unless I'm connected to the Internet","rating":4,"review_date":"2026-07-19","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.x8bit.bitwarden","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c53673589b1f…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.