Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I get more than enough value for money”
Google Play · 5/5 · 2026-10-08

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3178600936

Proof data

Record hash (SHA-256): 97857128f67523ad622f837245e19ce5b48421fbb5a3ffbbd740d138adfe1acf
Signature (Ed25519, base64): eA/MupCPFRuHSsXuPYILv/pVONIZaPftBZuucs8dh3UwJ+C37Ba3tBbNT6KDv5eP8xFt+MWX1dWRN3sAsayMBA==
Merkle root: eee462924587f8024361bc8d60043805cf5210f8bd2ef7667df06d093552f9e6
Merkle path: ["9783c83cc3ef487e5b2f91226e4d5432b347ed39f4284ea9e7fe80d871445fda","7c39ec6516369091d11b21ffefe676e5857a08205f35610c1226e9f4b19e5fc3","543653bff7f93773d6bfbb9e1d972cda7d96872e56e4599326ce855789b3aa6e","d9d16b089f932a31e7c591fb51307003fa0aedf16999815fc876f50ec4a22c67","0c9458af6ac70284f8dfbc09cdcce731862c7ded7e813b542198eab258158100","608149b02d9f6b3ea8bcca5d0390076d7305281177f4526dda1ed983980bdef5","a0b4be77019e98a76028f8484c05f5f0602fc3079042faabcdc0697ffa3f2047","99f62f36633b52878b06a97c27ca68bbe7ec8ef8b919cc6c212df697bb38b7ee","160f934cb55a722109fe2c3bba72c2489a9dbe3b54d4fb52ac8328f8cb2da5eb","b4d008c8f1ee8fa93886dfb7ce323ace2a894eacaa83ceb42f68040097342684","35ca37c75727a510daedc47db8b680270c0bcf01dbc7b562eb73f2b4a35aeb92","03109236374994d37cb03d835f824eb739eb2a726edd95454da9d25cea9f6c11","7461bc2d06b1d6bef7145de580cb46d87ddc9fa66e098a96698a96372c033f50","f5776b4aea049b369136550a2eba5c5f94aeaa8e5ccb2b2ad336fc6ccf74ea7d","452f4fcbca19997a15e6a6869c50e026ff02cb90a6ef21da106ee0457e55941a"]
Anchored: 2026-10-10
Public log entry: search.sigstore.dev, log index 3178600936 · entry 108e9186e8c5677a6a91…
Expected log hash: f3dccf508afcb5e89d56dabc8c5aead85de215b1b896d057d463ea1c1bdb13a3 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791606586319","kind":"published-quote","locale":"en","page":"brand:spotify","quote":"I get more than enough value for money","rating":5,"review_date":"2026-10-08","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.spotify.music","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (eee462924587…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.