Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“this app is garbage”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
9f3210ff55a1e49c3169fb3faee5d3701d7a96af565a7b4e6e83491ee107cc70
Signature (Ed25519, base64)
Z92lNVbA+QZIHe7Cdc3Lg2F3aXkkuh/NMCCq+qJ1rItKY+daW3eV8GSIZBE4N7M35p5ImfuDurdCV98GVcEjDQ==
Merkle root
49133e6803d24035baa1544a5c730db93dbaf832df48f680ca855944337404a2
Merkle path
["9f2e20d7a77475a037fd86d950f95b7a29aaa71008d2406ebcab2b9159577a39","c8c887ebbe30af9f1e3cdd9540d59b4c3fd1c53936f6099c1e1ce96289272a80","a81c01db86075fd9aa183c060af492ea532c0117e41e0c6e4c5d3358761b9112","6e6fb55af7f5ff6677eb46b5a352f498ef8a93a3ca3ff9b6ad7742e9b8b61188","4368dca1e517e74ad989b10bb141df5f7d13561de577a9ee6b5c4bdd15411c33","28a62bf0e4fd20ea96fc5ef2a0b74fd7021a65d02f51a601f96d174c08dbf2de","179772a248e5bb38dd9a359ba2e82b1f2affc447a9c449940f683f0bac377c9d","a4433f11dca73b6392d45fd3b1ebee659ae3d388312c14b2b2cf575222c9fd40","9067ef4bf7f8b965cfe6d499bd46d3141cb4fc818c1d814b6dfc6a65aa3ecf3b","d19bb96a7e0449056f27937712ead4c424bd80525d4da81f8bdc1d0ef05a8318","20cbd94a1c671667e9caef0faa56ba9e736bcd1b7dc9e91fd3937d68b0d0f8de","62cb3735bc78d2fba60e7ea9cd1bfed3f29a37011e58101dbfac3a4028d86eb7","64f6e44d0d153cb01fbba011c770c85da4e2899c81c01e95d009474dc99d3150","541a456de48928931fac4c28e56562983bd2f8cd0c9306116286df2e2f1c9422","d81f506ca96dea712a8b56759200b270fc625cf496d323ded3475eaafeb2d916"]
Anchored
2026-10-08
Public log entry
search.sigstore.dev, log index 3139760477 · entry 108e9186e8c5677ac88a…
Expected log hash
d54b6e5e20903e9be29e6a5973227ee9b3dbe61bdc0fa6481a5788472cd5976c The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791428432986","kind":"published-quote","locale":"en","page":"brand:wave","quote":"this app is garbage","rating":1,"review_date":"2026-08-20","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.waveapps.sales","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (49133e6803d2…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.