Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Bonne Assurance”
Google Play · 5/5 · 2025-01-18

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3161668256

Proof data

Record hash (SHA-256): 9eb107dac3278849b9fde41849f82c55a96aa0c4f85c32e55b81797619e87228
Signature (Ed25519, base64): BV01vFFm/uU9P3xpQieRODtG6zlJP0PQnjponPiRAJzvuGKE9vsQt9vXIEhgca4ThRve6bwaJbhbhOiok9xqCQ==
Merkle root: dae11b7f399fa27d7e91aa4463415971ac3f4413815a3c608e4b798805e78c60
Merkle path: ["9eaf6696f1b6f46c360c1cd8424d3019b486afd34723730cb20fcf75c327b86a","b2544452de3a0cf2a267c68ef23a0bd2e3ec2c2e73a95139d63db4ddaeeeec0f","abff096f3ce7aa8a276939e90e5465dc1803d7f5cc2ee03fce36541c4a4a4547","87ced2073a1a02fbd40f2260e30df117acac41d33972e60dd46201f51234321c","3576d705364117850c089c20230ffc3413696e9683a59bf83a26e8b40450024f","88f6673a9fce038efb8a009d223dd12762135b07e95ef9f4001d8720212f10cc","cd0ec7937d46a91e958d6d1b9cd2d0f5604f8c61a6aa7188093fce4036e8f102","833bafbcf78cbb3cfef1add01ad5c131f2ee4dbfcb3801908f35a0aead4c4a94","c4c0606e7116b6f28e50a5c85c2d55a7f6f02e2634cf924aeef3e4601ccfea2b","7b73b82a9445360e75c7118547e6692db4e92767465cbae5cb92fd4678ff4245","5c607fb6c96a0b8fafab6de711ef3ea538dfb6ecd5b7698ef27e868b0d0c80b0","07af147f771707a0c35370708a1ae511033c996c3fa2daaf491e213005f4acfe","e682c5b8531aa0523ade0f9090c01607519f74c84ae161ab5a97d9ba76d9ca16","cb89e28452cf165e4a31aff66df6db708b33cc82c83ca8f866741bb4fc87bca4","6771b856bc54b9b41031b35ff7640ad54c5be8f800e1967d73d242437a9508b8"]
Anchored: 2026-10-09
Public log entry: search.sigstore.dev, log index 3161668256 · entry 108e9186e8c5677a744e…
Expected log hash: dbaeb9745833827bd692133822ce98bad4dbbf6d52d00fcfdadfb4c533d214a6 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791537031439","kind":"published-quote","locale":"fr","page":"brand:atupri","quote":"Bonne Assurance","rating":5,"review_date":"2025-01-18","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.atupri.myatupri","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (dae11b7f399f…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.