Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“allowing user to disallow the card display at some sites”
Google Play · 5/5 · 2026-07-28

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3100032352

Proof data

Record hash (SHA-256): 87d44f3a5d36ea283fe67dd133898a4f52112d1f518a74a13c24211040158a72
Signature (Ed25519, base64): 5n7Ae1g9OY9bKv+tAsuTdf8gFY0WH+ueP3GTlKq2X0bMP8VFSA+iLPHZ/OQ/tBwvPUKXkb+rrgDWuplncc5OAQ==
Merkle root: 61203b6d05350adaaef087cbce75d25fa5ac2036c1a66344255fc73a224d39c3
Merkle path: ["87d2ae9b3a243c09d11eba8d8b80e382aa2958cbe1079d7ab8f6f12d6fa09363","3d99ac14d965cc64bab7e5f556c1a0de5535c4a9d1b3892bbe1f7e65850b23b6","3da692da2ce135d46c32c7f0efc8602f160d66ee6fcae057c167a6e13ee5ce25","8fdba1e7a53d7b7ac2d9f9d162fcfbbdebae9fc6216611d7b6820f3f1c013855","aabcf11708f56d25ac53f08a4bf8a9cb8120704d038bad7b179786fded4578ff","b86f3cff2b90bfdb9ddb4147ede0a1c5815b83303b83ef23809518d7dcf3c41f","c035eb03282cf3ae9f4e495a0a6ebfe86282921db53c9e3d67a8e526d3abcd14","c235e3d0c288a27e360861a7e13f3b465ee9b03fbaea8202f52575b01a726da2","36fe6222eec241db6879a85004bd951be6a617371b1e0c71dd130263e66172e7","fe5d2e2db973d5994d5c91c6e6b9886828caf013a5a1da3abfbcac318f13be4b","f0609fbd7dc9088b3c09d3afae43a848968b097feccf85c8f1d9fe856a421ea8","3313db6049e25cabd426521acb59d4b355dcb9f4ad2c34f15c749809d16ee4ca","90adef19352455ddb1e70037a18d38e4a92a2d5b71963605de61bac446a255ff","8623ef0c7509529f19128084f674283d15fc3b4b9165c3273da961b1c9f411fa","d35a1781f2fb2fc9cd66aa22e2ed6cd805ebe75af0ac2c167c3e4444a0a6f362"]
Anchored: 2026-10-06
Public log entry: search.sigstore.dev, log index 3100032352 · entry 108e9186e8c5677abe62…
Expected log hash: 0a0ca7b748f6c99c5a75a761289092bb11c807eeee08be8ec366fad5b0bfd2d5 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791253605372","kind":"published-quote","locale":"en","page":"product:bitwarden/family/en","quote":"allowing user to disallow the card display at some sites","rating":5,"review_date":"2026-07-28","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.x8bit.bitwarden","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (61203b6d0535…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.