Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I haven't received an email”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
72be04b33e1824cd4c8ad86f20a7176790e8de9098876c9350861adc63509a51
Signature (Ed25519, base64)
R+RNj9mvAFwrsiX7FftPPOiU2K4mYqtvmU6h+nuEPjO3PiM7c0lAX1Si6O8fXXA5qHFD3oyCZQJw+Iy2AXaYAQ==
Merkle root
714fd5c453665fb7238b83bb755c09ceea4f24c6bb04f621046ea8b9d5da1a83
Merkle path
["72c20b97ac5cbf05f50797c7e2fe6c06b04a4f79ce3621944db8a440f25205da","2a1b07d4b059bb62398a35b64522d717cf64f87156f384cc2884a595b0c513ff","33ef60deff8498e4fdf5ab8448d6506b36263873e6bd705cac48a83890016f4d","08ee95d903d0424a6f2ea188fd205dc19efb83fc9e2ef6192092d80643bbc2d8","e9987f33b529596eb9a063ae40484732da844fca9475c753eeca2812eb80673b","f984ca579ee325e65dcfc6bcbe8417e178846eb014c5a5956a0e2dbbe50759a6","184f865ba9ae2d372cd2957cc2525264744037226399ea8e1999c3264888dfc7","e2f1efe5a5843366a9e8a0b8fd95ad43afed7a430a8488a532d7359025a11031","b70e9c258e16665a5fe45d6a0548109cf6b440db43ef276d2816231b165fac58","b3db1bb860c2472da12828b1fbcefde4192e206d618588b5d36d67009ba3d271","b1ff582c9329a9885fdb29148fcee91b64f932f1d50a1ec8c277f816b9f64731","a1806d0e598422a34e238a3192e988159997b8ebfcd79db1fc17fa0783cbd16a","8e05923450d0433b7639ba6d964471cde4f69e8e573ff3bb85a421b4525c202f","752a3b9e223b30ac83f5d069b1fdc80c8e8c1a0ba82d33eb5f08ea95ad0f5112","0657d6cbf3a92507a9a9b11146527ccd4ea9969d68d2d85c40e1ac60d2ab4392"]
Anchored
2026-09-27
Public log entry
search.sigstore.dev, log index 2969645630 · entry 108e9186e8c5677ac05f…
Expected log hash
9c269d3e82dba16de30aab3330968f6013b6b7908bdb2f7b3ce0083771a2fe3e The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1790397996853","kind":"published-quote","locale":"en","page":"theme:bitwarden/communication/en","quote":"I haven't received an email","rating":3,"review_date":"2026-08-15","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.x8bit.bitwarden","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (714fd5c45366…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.