Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Despite disabling newsletters, the app continues to send promotions via push notifications”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
835cc534298624260c568faf348d5398875e4d35b72544b7de126b1e05ec3793
Signature (Ed25519, base64)
tUnmxOoYc/L9j4ZfFZUcKkvWpJ9GhsZS1bruxarWkdPyu4XBwLj75H7FiNh9gJw4OtbHvstamQR5I5QhI+ukCw==
Merkle root
5c4849a28e8624d6f6d3204e1f81a6b24f2188b6690e8b122801054617ca25d8
Merkle path
["83621dcded10ac75ff561f6b002f2a7bb0b3630fc1a7473aee665ffc13717c12","ce67f82bac42a5499b5e97d08c7e7d6783f2e111ac32e87d1e88ef762ac0048a","274dfebd3a2b9dbf654de4f7b7dcc512491312bdb15396dffff5b3c90b7c664d","6a31e08632af5e1a67b78ae7e233214539bb887c56e3e053a071ee4dfa7b14bc","b2ea8d6e672b248fd5fbfa17858bef3fcbd9d358493c336fa6ee9700b4781b8a","39b1d66c580231efeabc4d9646532978353c0921d1e074cd93bbcdcff3a5e459","35508a387dabb244e7c571c26fe53af3d98379a70ab67ffd34bef5e8aa1c4a92","9782a4b1e850caca98cdf3549cca0faa421be940e7136c11cc27729d41b7ed76","124aae1a675302ddc1dbae3131546b6aea065ee8d31f46b27a4394fb307b4b42","7b1debd438a9bd86c2021504da857860efa58e5f06710f620352fefcc1881b23","cae48f498550605219f4ae6ef64ef5b4d83b09768cb2a3dd1f9ef5d938f78697","e09225a951a50088525e8a7a6996704783b2f3575afa2d0547574736c21c8bdf","12f96ca4240540bfe75bf803cb42df83a15718abf65320073fe2c2d7c1da740e","855df8175222f9db398f9629c729494a6b2f86ecb26c7fc54bbd061fab2ad520","649f189ed3a422a3ffceae7f7673f3e683a1fac940fd27a4d89bce585dd48e49"]
Anchored
2026-08-20
Public log entry
search.sigstore.dev, log index 2524617489 · entry 108e9186e8c5677ab139…
Expected log hash
2051fcd76f2ba790414bb1c15fd4d3d064889742ea46f8e55b5028f1f571c27b The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787193158162","kind":"published-quote","locale":"en","page":"theme:sunrise/communication/en","quote":"Despite disabling newsletters, the app continues to send promotions via push notifications","rating":1,"review_date":"2025-12-01","source":"Apple App Store","source_url":"https://apps.apple.com/ch/app/id466738063?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (5c4849a28e86…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.