Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“How hard is it to add a warning for mismatched client and server versions?”
Google Play · 5/5 · 2026-08-12

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3123541116

Proof data

Record hash (SHA-256): 730fb7c3c59015ab423f1102e5d8a336594887072a7cc3dd11bdb1a04a624424
Signature (Ed25519, base64): nPxRybkfHJymKtL8MwQd8A9UEO/mNJcKdmIYExd1Aq9hU9Kbsga40LjdyS2gXjNEVIM6U93WUh1MBZcoUGUtCg==
Merkle root: 6d3f7b9a732acc39631b9b7a5990b6471bf710c9f84e5623c7b4ff4e1ce78326
Merkle path: ["731131908a3268e9a9952d9739244e76b8a26d21ad23afa74588716b86adcab4","718807d2d8e6cb9b744db2b1156deb1f9003c7e4b724c0be861b08696d750534","09332eab54a3ed15f9d0d94041a796c2f6286dcecce0c671008691199860b96c","ca7d97452ba2e2f0d765a0498ac0a0f87b833d91797d8cba3217e7d3ff979c34","f4f299933d9e079f957c5185126c74347c8850149b4844400bef8a1db9f28adc","d075389f35683a96056a5fd757eb50a0b7a45725fd219a81e5b29acb2d2ec57e","9e846fc759eb737bd8f47973ddd81cc0270a22915756ffefbeceee8d7af23d70","e723af167ccf04dbee928d2ec8be60adf89ba338dda0fecf6b188cbd52a5cf59","02e78df3ca96be3850e172713b5197b175e2d18fb7fd5879d2bea99a9d639536","78bb1225eb2c030d939f956f8f4132877c2f72c7398acedd956f9509fc953fa6","94ef25e587448b4297c174c00422e0693fe48799207d7650c57529ba6af2d4b2","f093c8b1412e3d74354ea8b22e9fc3c489e9cca32c72cf25d4490d167d893c7c","43e340826c4a804ec6f5908b8b1b615e9056e8f44741be501b225d60c6223909","d55f41ae09ca42c33bbe39db949f63edb982eb2698def5511ce57c4f872a5c0f","6036173d1fecc6618a44f9a6eac2357cbf937f65066abe2621a2b8d1580705f1"]
Anchored: 2026-10-07
Public log entry: search.sigstore.dev, log index 3123541116 · entry 108e9186e8c5677ad86d…
Expected log hash: 9205615d16e6f0d1c04ec96882a0dde4bf091f63aaa636cea18cbbe885fd5227 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791346951310","kind":"published-quote","locale":"en","page":"theme:bitwarden/communication/en","quote":"How hard is it to add a warning for mismatched client and server versions?","rating":5,"review_date":"2026-08-12","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.x8bit.bitwarden","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (6d3f7b9a732a…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.