Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“A pretty good music streaming service these days.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3163461995

Proof data

Record hash (SHA-256)

aa901d23eb16c831f273598f23935725c5f3b81e383594a5af7fa457f7f65009

Signature (Ed25519, base64)

cGrWm1klSsGrE1HLwbZ6gjenCBl9jQzcdmZf7TQ+g+ZUKG2pavsUJDuiFHTYpaa5Az0foWkZTpz7P2T2Tc5eCQ==

Merkle root

f2dea3193623a59d18b4d230cf1484689c024b05d34648a4bedfef78c47360d2

Merkle path

["aa937a31343bfc86eaf3524d3b785da37991e3312c979bdcfc9adf6db9db42cb","a5e0f19b2a1f9183bfa3a06b87324e7a9179502b38bc654dba14546b631a7e4f","862b5b5e58326700b874ad1795c9087c6ea4ebe7608b5fbfa1df490023c37715","44647b79c38c7b295b66a4464608650ef5bdb5da21a212eeea1ddbfdb6dec3fe","56a46e5217738f6f15e9ad59ca4bec16a9548a5deb5ccbe134897a3e951e9066","77395a0733d22c545b4418356e450e733ca8a8d5188c02c164e2cb2eb7032ebb","5f36c44cbd4da652044ed54af5b59330c52e1a1a8f89b1077fcbdc9e98a89b87","14147f8b5d04f8173f73e3fcc12b9e331708f66b3b165f1a66311b66c4aa7b2b","cfd8304e134252ad9a33e2699e348f11feeb51390658e45b5397ec09c3821b4d","156d35af7187adcd7595a5e71156f28da533898ac9cbd2b5549a3f495e3c34d7","8d8313dfbf99f19914af1dd252cb84b33ba17f84af85f6c1d71e0ce2955afcde","f0fc169ae8610b5034c8db3e22369fdfbf72b508df037dd1163f7e2985bcb7df","aa8abd53e4cf01bbb2bde782f5c5ec8ab8972af72f6d45e006b1777c3f44ed11","3cd750b45485739a93e8e5963aebbe2dbf3f2cd6fcfd5ac889ea2792f103cfff","658fda4333b0a975ae51c0ef52c37c157029d897878579fb5ff3ac48198b1bf3"]

Anchored

2026-10-09

Public log entry

search.sigstore.dev, log index 3163461995 · entry 108e9186e8c5677acea0…

Expected log hash

1e385e1035f15f3dbe860bb8f3e4e850b8c2ce2b31edb58c97be626995a4adf2 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791544610158","kind":"published-quote","locale":"en","page":"brand:spotify","quote":"A pretty good music streaming service these days.","rating":3,"review_date":"2026-09-20","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.spotify.music","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (f2dea3193623…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.