Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Xodo please refund my money.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
a40c01219f7fd8849356f620326a99c55266b0f28c13260bf52ace703f5fe24b
Signature (Ed25519, base64)
FSmuT7vdIWdrtpYPkn7F4rD+pw6UAG9nUUk0eBbbYSacJ9BbkQqWNQUqsVqhkWl2RWpL2t6tj6KiKeAhfZIKAQ==
Merkle root
5c4849a28e8624d6f6d3204e1f81a6b24f2188b6690e8b122801054617ca25d8
Merkle path
["a40cdc1900d92c25506f5016f7f9295bb84a88e367b8db9279e4560948d9c8da","216f902d5c5f00c76fcab40945219bdb8708ca654b930db2be22b47cadd1eb6a","a476e07873772a5745b7e9fc6d7b02a56f1bb9ef16540f8d76c6f61586aedb91","8b9d126d5306618c1cbe1f2fd1fac2808354cae04f4b982cd717e0dd293df325","13db72b09a0421eb7734a31b10c2d13252ec9618b7daaa31982c3f3bf3e3df72","b673d42f2bda0d97dbf0549fb8ead1aa815da572c361d1a585a90b25d21a7fa1","c749c5cfff45695e193b16dd6ae26deedcd41e450215b800a51812b54de86c2d","629e5d6f526124970bad3dbcc6f5096cfd496c1c3b925430316dd54de9fbeab9","071e073e153bcd88f9b1a52d1468f8f734c14e1d5185c8accd5420781dce2bbe","41a36b951dd3f9ea52bf0b91a8bac297d79354a052287a232bef19f463cab78a","2c9b83ccc0c11114cfb6098ed2bfda024c744847d4e5df2ea085525e963c117a","a6f0393e672db1f7a42a0e48f58d1ab397f70d4769af231ff695e788c43f5323","6f1e467d4fa619cb3e08538173acf01a50b505f4c6c960921062ac94dca51c01","855df8175222f9db398f9629c729494a6b2f86ecb26c7fc54bbd061fab2ad520","649f189ed3a422a3ffceae7f7673f3e683a1fac940fd27a4d89bce585dd48e49"]
Anchored
2026-08-20
Public log entry
search.sigstore.dev, log index 2524617489 · entry 108e9186e8c5677ab139…
Expected log hash
2051fcd76f2ba790414bb1c15fd4d3d064889742ea46f8e55b5028f1f571c27b The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787193158162","kind":"published-quote","locale":"en","page":"theme:xodo/returns/en","quote":"Xodo please refund my money.","rating":1,"review_date":"2026-05-26","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xodo.pdf.reader","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (5c4849a28e86…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.