Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“app is very feature poor”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
71e3c02b9a52d9b844f9043e892f4378d7aa79f78f04b42494d46cf87b9929df
Signature (Ed25519, base64)
yTYERqfdXiB2RZyoQrZCmxhT0N18keju4LW+sh5L+ng/jjw2HHtjcspPhhMSNOewswYOhsPBKLnfppMUoarDAw==
Merkle root
c5671f9a997da9b293a79ebe58b20e4534ae608121169f15a5adc358d42ed147
Merkle path
["71ea777fe33173c67f6f7b8c5559d21e4e4833636ec96497282b03cde027fc51","ebb93008d9e90e74cd85172b8c6766e62f7c3ebda474f9ee01ac428a64255df4","d023614720a822019bbd63182773c399a9bbe22d23d70b94fe05a47c26b03849","d34ff4e2801efeee54f8c00ae737e49bcc7c1020a08f65ef8b282ce824a5f6d5","6b423c388e7d4028ac2e20cd7faa5c4e8f398093302f8da60937d11a766378ae","7fc41ad8703e9574609ec7ac4f063df4ef45cbe4b393ace7ddfc0806d593e82c","e71b0217d9eb8eaea128b1aa95ec2a7cae79837f6891528b8d6e5df1434aedc5","bb8ecad32d845c8d8e9d1f054f97ba8b84b852b820fc18db019a4f43955d9e06","c782db3782b1daaf620a70f12e8aa1249e3730f29db0449f26674c75169614bc","6fa965ef55ade9edc8bc88642f7af9bd49ae9544a8069f88eb58a93d838fc247","be64bb6cc0bd62f311d1d9621bd7061474350223768ab253e9ed7c2b95e527e2","d8520b55274a09ece586dfc9db3ff24697cb30ba561f6997e773d2fe7c0c6336","2c0238aa19b5a3f7fcc2bfcd0f9715c9986ba50aa3f7003b4c30be226b541d53","a2027fad4413a16051db12df072fc2064ab8e50a759412f73c3932ba08f51b55","064efe6476d8e8bd839601b3c80763b02793c41f87cba57580faab7c00dda24f"]
Anchored
2026-10-05
Public log entry
search.sigstore.dev, log index 3081733041 · entry 108e9186e8c5677a0bbb…
Expected log hash
88ab7ac46d4614551fa6e665889f054d7592b15d91016a45621b5c46a7ae8e2f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791174108170","kind":"published-quote","locale":"en","page":"theme:xero/quality/en","quote":"app is very feature poor","rating":2,"review_date":"2026-09-01","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xero.touch","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c5671f9a997d…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.