Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“How complicated can it get for a basic use case?”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
a56f540a9fe54e2daf738ac8e7614c1b8e476fc73dbc84b5aa486a0824bdb28d
Signature (Ed25519, base64)
6J0ir86kjU2UjH1PkbzTMZhYGOs+ZvKqxVUPdcbDo+QI7V0zZZG/u1sokqiqmmezDhV2NrYFUlnR09NIdDPKBQ==
Merkle root
1dd7fec10002d9304505761bfad9c0f048c94d1d6a0775b6fc4291f712d4106b
Merkle path
["a56fa0e4cdcc37cf224c14139be087f069e9be99f52c4a7a8d886c290e4b4308","3bfbb8c79e76153df9633ac900b42ca6cb6a31652247c5a08442d8809da28416","9f7b2e2bf8be720bc09eee87b6720df9297ce00bc5d3a5bb1700c39707132c1b","8c772f2c1eb6433c5b00ca4ba041e67607dc9c5baf9fade859d1d89b9a4d9d48","1564b5129cd45c2e418b3035af99fb0949ea57ae2b5e8ecaaeafdd4103814ce7","44047017cb52acd30615df637ca5da1eaa2ffb0df8ea0e913440419ebee62b53","867608a181f66d2570515b367117101511d2cb5652225fb5ed0d56d11c78268d","c621252e6033324c59788479441d6260a25e9f46318305799699d0a24892da90","2a7e62249d625b36bcb09c6b0aae6d8a6404a1cc6a61e9b8da667a5ecc94e481","38ada5adf578c9a2995257f1eeb6e7e289b902c15a3df7634cb4bade53bbb392","640e523cebdb385d6864d615a0bcafb46204b3241afcd2277c3c5d5a687c3449","60c16bb8599c61ef6bf8fd7d2d325562a7f4e3af9a177f7e22f900cfa3814919","586d4592836e72d5e1281c68f8e682a02efe3b0db75e385c3ea0642a1befbc5d","446b814589c9564f51a341535d393ad23c1a9958834addb7d5c07c1be092092a","54bbc2d7930ffae8e416e662d825fe408002ca5c9c581c2388ff0eb5a37134ae"]
Anchored
2026-08-19
Public log entry
search.sigstore.dev, log index 2514297706 · entry 108e9186e8c5677ab801…
Expected log hash
861cb9c1424d2f408888a591a8305206c340f8249f4a4581b32f940ce8815405 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787126020727","kind":"published-quote","locale":"en","page":"product:pixum/fotoabzuege/en","quote":"How complicated can it get for a basic use case?","rating":1,"review_date":"2025-04-25","source":"Apple App Store","source_url":"https://apps.apple.com/de/app/id1319898516?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (1dd7fec10002…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.