Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“geht aber nicht mehr..”
Google Play · 1/5 · 2026-05-03

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3199819547

Proof data

Record hash (SHA-256): 97126f2e9eefc1b20cddaf405a7a61d146aa7c46187b1a726cc46f4a0d022558
Signature (Ed25519, base64): s9/Z4gqQx4mTD4Rtn0MkJnlIL3pkJ9GO6bY2LDOM2AgadQAwhxQ86hlBrsqJgqT6LgeFLjXpEl5afW5qNHV2AA==
Merkle root: 00eb1252356f6576712ea4fb614a5236163b3b1821e2db4cf332fa9ac5a6c4e3
Merkle path: ["971c3e167293b1b227068e4698bf5e4de0f937fcf66f57c93e34783c5a1f1298","ac72ee8dbed27bad6b4eb1d7573558c7b8ef9d3c200b82c32b64890d9a1fcc06","8ed5fc27d3b5b0f0712b698d13b9d326731352ceef2966a0fd1f4854ffecc4b2","71260edf2534b7f81fcf4ca272155533ef98bcc3b6344c6cf1ff0f994dcd3dc5","f02df82e582295a77a1975044f840812871eed3e0601420a7b7cd3dd12f8ffa6","05939401f0ec0b96c320d85a04cd7bc645dfeba6e1beb41b10afc04d8e9ba0b6","0049d38033114abe46720e7001d8bce7d1b7a4fb707f3cbffd46801282c71bcf","22bd0a0a15b9f5891e6530677c8a4cb9a27f21a8941f4ebe3d06e99491efb2c1","ef66ffb10118f3c4aaec81629cd47ecad006f2495f353ade27d9839798eaf6af","38f36084bc3ac4508ff41245fd1e67f5bfdebb54be3d99090a1189ba13ba5359","db25b13b470532ee626a27e4ad84c38164f3c499c5b510472e6eedb7e47d13db","3f044a602b7f011122d9ab380854bd42caf78efcb2c76070e856e3a1e561c2ef","8396c6db792aff923951a24a36e34c7bde1076d0ba7dd513fc1fc21a92246adf","2a16edabd04e899fb9e203b73feafe767e97ceab00dd96c47649f5269a3b0707"]
Anchored: 2026-10-11
Public log entry: search.sigstore.dev, log index 3199819547 · entry 108e9186e8c5677a0b40…
Expected log hash: 54bf23963e2d2d167d69cc8eefdd91558bbc8835be34c5469b6e0b1af30e4d15 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791691808362","kind":"published-quote","locale":"de","page":"brand:atupri","quote":"geht aber nicht mehr..","rating":1,"review_date":"2026-05-03","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.atupri.myatupri","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (00eb1252356f…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.