Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“The access code never arrives in Gmail.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3163461995

Proof data

Record hash (SHA-256)

71e6484ab3eb614c2282494605edba133b28fb56e2a1e0a03894be0c21d4d026

Signature (Ed25519, base64)

51ickLBVBXhRCtRBGJ/pKaSh8paGS9hXN7UFAOQrtixqrr7o6iSzwB77h9mdwCCPvrus1QBR73fFdbkvKok+AA==

Merkle root

f2dea3193623a59d18b4d230cf1484689c024b05d34648a4bedfef78c47360d2

Merkle path

["71e16131d3a182c50f03ce334517af5549acd185973317354d07a464b9ba68d4","35cab6c554f4067059197a4d09073fd89005bc6e92979dfee0fd672e6e9bd24f","01c2db76f9ca258b1953c1205fcaf86c568ba27b2a9a47b1d56baa0492540d07","15cc14b7ae00fc7417a85db6447b01b95adcd35082417311b6bce669ff8a47a9","96aa046835a6c48d2f228d8d8db162bc95a7c4145ee4f2ada57d86eb21003f20","baa2f0529e61a148013d3a9534b837a29fa2de3a421c04768c004787c38c1428","d3de6578b48b90b55fc0838e7b463742a3470a9287395f5dc15e1f470dcf4ae2","9d71427b095c1ffea1e9a6386c2d8927151640a4ba71dbf3e902b45f81e1b959","e86a2ca829b85025c4f565ad1a1ea13f322bd70d44596a8463ea809c2a745e15","bac23125c894da112fbf113901ca80b24bf4b270c82060f9501f04f9c390f0a6","6b583c21dd7148e63cc2737ac6e984cab4dd092e875f4f57450ae5020b4f9215","3dce281ca0e614b1dda8d0ed670db8d11da28ca67738915db89014b853040875","d5b457cbd06c72c301c050bbc18735716496080f1e92d458625264f50eafefeb","3cd750b45485739a93e8e5963aebbe2dbf3f2cd6fcfd5ac889ea2792f103cfff","658fda4333b0a975ae51c0ef52c37c157029d897878579fb5ff3ac48198b1bf3"]

Anchored

2026-10-09

Public log entry

search.sigstore.dev, log index 3163461995 · entry 108e9186e8c5677acea0…

Expected log hash

1e385e1035f15f3dbe860bb8f3e4e850b8c2ce2b31edb58c97be626995a4adf2 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791544610158","kind":"published-quote","locale":"en","page":"theme:bitwarden/communication/en","quote":"The access code never arrives in Gmail.","rating":1,"review_date":"2026-08-15","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.x8bit.bitwarden","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (f2dea3193623…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.