Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“or at just generate a password”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
6bff7d12e386184ec45ba604271de7717c47230dff08baeba815df16768a9fca
Signature (Ed25519, base64)
At3IqNLxN+LIrN6lTkNkIRDmM0IMPfIAsjBS9BcOXwzf2zEtIFB+ywiKqRd1lAcfmCyV0E/+EOHUUoSeF5DoBA==
Merkle root
a893faa173c6b378c8d050262e841ab57fdd89b71985eabc0906c40abd5b6a6c
Merkle path
["6bfc91c8433524f4774fc8f932ffbfaa70afb6e30fe4d8d97b7a8000e9d784ec","6e16819b54529c2e4f075abb2611e1801e4c392ff8a6389db274add62cb6724e","6680a0e3ca97851c047adc034ab369302ec67d57caba6796fe084e5a2e75361c","9aebaae6152d49c20fc355f21bc3cc176d8d0568a454cf8e3d55bd4be05b05f3","5801f1076d46ce5dd1165e809fb1f7c9b66ceb8650ac004697ad27270e28af91","eaa8aebfe3734c1593728f21dd7cd4970546b4ce265525cb54a94bed6186a68c","5a69644fe355f573b25b4bc5d3312f270d19058ed157b39e880841d9adc09c5d","89c8fff00772db4eb4d6b7a8c8177087a6cf146c0a7f991e1f0595d5becf8b56","d445f92aafcfecef5331c7dea366d7c338f60de74368efef65a87574a2ee5e12","b539295c3d2b795fe307b9fafe37a6c39d4f45d44fbd5741bc18dd453d9ba30c","fce3abb6f5c1a13cf97eb53f21ad0da7e906ead6593fdb4d1e2514fcbbb6a13b","4da53a33cfbaa13cad55449211a7d697594e898ca969385c4d89e8ee329f459d","4645aed1e8e492caeca2f1009242095d0aa324a470dee6327a46e4aff4cd53fb","c2523440f419decfbfbb1761ac468558734f6da135e5a329b4c6dba0ae899966","5153df72155ae00831ba1e4416296382c39280ea82c989972042c066f445006a"]
Anchored
2026-09-18
Public log entry
search.sigstore.dev, log index 2882354328 · entry 108e9186e8c5677a08a7…
Expected log hash
5510a497abfe2e680a39c301b0d905c2a575bae0a1f389fbdd7b86babf05240f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1789619628558","kind":"published-quote","locale":"en","page":"theme:roboform/ordering/en","quote":"or at just generate a password","rating":1,"review_date":"2026-07-13","source":"Apple App Store","source_url":"https://apps.apple.com/de/app/id331787573?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (a893faa173c6…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.