Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Malicious apps installed without user knowledge”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
8f1734c0a8c7cf006aeee87c45fee14cd98d643afa672f263172b762139a09c4
Signature (Ed25519, base64)
eMdNPzqgymHghyxCNz6d5tj8ec8BPK8VbMi9a1M3ax6+x2ELJaL0rYXd3RM37RqXqJRxY2tN1SqGu48oMm71AQ==
Merkle root
4dc0bd79ba3e9442f7f1feb21f347e2f6fdbc72e99098aa5164776a6202654a8
Merkle path
["8f166dc90e3ef0215d99f2e12ff01abf76baab9ed5be54b276e5c06952bf74a6","ef91d2a2464d443d9e5742c9fb889cca98721126cf813201a26f4f44fd1244ea","a65e4ede68a6ce4003b375e2c12ff8ac2d418a9b051ce21dcb5f506a2e76a9fb","0b38c513575a11d6fc432303b28280b09b08f5d943a84d4755bae07ab8653390","56181ee37d39619400e8fa66f175f90e0ddb7d9fda0a28c41563cb5991306ecb","422d7a57a7985ac8766e8b920744707bf2d19bde915fceddf856e1a68d1824ff","59254e57c18e8a85f5bb62a2bfcff96ac95b5b92911d3823de9fd81febe702d9","1a47b9b5a0a5ba16928c6a1d1989645968c153a9561253efd856c69625c78292","b80a8a00d80e0d68abbfd30ac4786c53cf9421c3b5aa58cbbbdbd3e0acfd5798","bf36a1682c931c4809e32e150a9ca80cb5f9c0af12fc903b664681dd644dea88","777b47360691f2b3b57e757f270b00fcea5e34e7a46ebf4242b7d849caab7641","d26424069f8ebada7d5db61084db1487cb6a3d9e3a9d7dea65c859d46af6bbd0","e3a1de018ae2658686c8ef0556fbf43b0147585a01189da83c1927e13f8542e0","d3f9820ef177ffb6742d93ecece273e46037aa87afa8ee19fc7a0b34f6ac592a","e60c2274998b06992577796b6abe86bec144203fe960878f7951a3ae12c9e532"]
Anchored
2026-09-10
Public log entry
search.sigstore.dev, log index 2776103867 · entry 108e9186e8c5677acd4f…
Expected log hash
2498329b7eaf275d309293dfbac35d05dfb8a55c65956add8448561c05945f28 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1788848066028","kind":"published-quote","locale":"en","page":"theme:dashlane/delivery/en","quote":"Malicious apps installed without user knowledge","rating":1,"review_date":"2025-04-01","source":"Apple App Store","source_url":"https://apps.apple.com/kr/app/id517914548?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (4dc0bd79ba3e…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.