Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“APP funktioniert”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
8e4f292e42f7f1e035bf589afbc8ff1d3c59dd277a0a9d895ff27103ac1fe67d
Signature (Ed25519, base64)
QqZhkqqcxj54kAgmeXDzuQ1yl1/XmWJ1XwA4kdlqrQSZCB1wEIpEw8WmCjF8w7FrGGUxEZ021KmdAay8LjCHCw==
Merkle root
cb5472fa7b7f10b7453a4f782a38c5dbb3d782ac291369ed3830c2ab783a230e
Merkle path
["8e4f464c9e18c7e243b3c4f785b41105905e6514d693cdfabc7ca4bf65bd94f4","8ca4d3dc708ba0815e3992daf8c07631ff4dcd2b3ff72df2d1531b8f8e17bb54","ea52d01da854ca4213906ef7d361897b8f62fe5a3c0ad21573e2e113bf47d1f8","4ae110cc59b6f4d05f96194ac0d0463a83ba0a3be5b92fffd9f63b2446bf63b0","4524855e0175d2126228a47c4b9e1f956311c344f97d2f5300270cf5ef9a5839","436304a653a63428d11c6e0dcac3903df89640bd490de98004aaf821a00117e9","71032917ae44aea158a284f59229b6562bb409ce4e0427d1c9bc4d9690048900","e4f961486597d5cf648b08cb44fcea9951d76d4efc2f71222d598264b15df37b","1857db08715cc5b148b98968f9c2f46665837e35bfa3c7f1842e80f7a833ef87","0e8f9a5180855335d724ad8cd38d71119c1a0eabb7b809d27d6a4b6beba56f49","5d972ac187c7eb665d1a4798adfbc89e8e0a77272e9b08340949e9d23cf65e5e","298176119fc2f3b3a1dab7e656db7c970d8ec6f10b91e4ac29f02827c451df7f","4a6727126daffc2e2ebfc8d3cbc74674dac5a876fea9b7ffc3ea5e7c28e2e01c","26f00ef18134c3a71192b8b80981be2ea073cd811ae4af22a2c976c20fd1879f"]
Anchored
2026-10-11
Public log entry
search.sigstore.dev, log index 3199295725 · entry 108e9186e8c5677a3fc5…
Expected log hash
59b8cd8284c909c35d85f443b6a086d482f8b667c56ec942d663937a75e25638 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791689736846","kind":"published-quote","locale":"de","page":"brand:concordia","quote":"APP funktioniert","rating":4,"review_date":"2026-04-13","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.concordia.myconcordia","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (cb5472fa7b7f…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.