Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Doesn't find the usernames and passwords associated with apps”
Google Play · 1/5 · 2026-04-02

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3124493015

Proof data

Record hash (SHA-256): 81797bb4d03544f75ee018a90069baaa875865a6d30a91558db5505932aee496
Signature (Ed25519, base64): I5aYxdLmcgMXCBhrmW+bXOjy0k0qoQWqfPTd8NqUxBsT/Vsg6TiEQZroo1IxY4QAzDoVOoUCbXBIYVpLbl6ABw==
Merkle root: c481d62412848235567fda063ff4784e8e49df41ad8b5c570de24ba396415d22
Merkle path: ["817744a4f1be89ccbb2a064323a1c22ea2f7cb40d562c57e1c5ee5f03c548f99","ce859aa13c95d059ecc2ab2f53ae9219db51891579d081edad761e7054b6ed00","7b042a8ebc42394cf1bbf11dac8e26d799b826d3915793f0e7fc0bb02686479d","ba7d633d72670ab691c55be19f90a200abe29c4237591efc35c5dbcce63564ae","04c60f34e0d4fd0204c0c6d407bb9823d58f7e37a60f2a4804dfbb3b781a18d7","70e5e648a32d392321c219f6bb3146440c09d4a0a99794670eb6cf824447fa41","6f3844172b839ba8b3f8eb795d9978091e39d5d43be087ba3162be9ae6db04f7","43c0a39ecbf12a7098f3d998c93b5587ade6c5090e1fe489402ad2acea9bf699","e198f9524fc9d1c94432588acfbef293ddc0cc31055c0a0aec3eee20554aa4f2","de812d1accce4380db3d6c1ca4654a6f8f4f18f0fe275d6971af3403c8ff1fa7","6017dbd071f53fd8086419bd45fc936cf4603a7e584603c0352eb7f6b328a073","d82afb5bb49cd0ce250433d864ef27b49a0517a79ac37abe79ba942ce0d9e936","bdc886b04b862f522fa884232ee2802dd3e2158164f68a6191101ce8a96e154e","f6587866cfe871330a583b5c544cf843720f2355e100491ae5892f3b03df89de","0cbfc145d581a4c4b7198ff8f397c34cb4ba6263e9e9892372f878302426dbe6"]
Anchored: 2026-10-07
Public log entry: search.sigstore.dev, log index 3124493015 · entry 108e9186e8c5677aee70…
Expected log hash: 0056b042c00529af1248b70a0a2fbed761990dd7841ea722369c29a2685ea6e1 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791350987184","kind":"published-quote","locale":"en","page":"theme:roboform/fit/en","quote":"Doesn't find the usernames and passwords associated with apps","rating":1,"review_date":"2026-04-02","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.siber.roboform","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c481d6241284…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.