Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Needs app pin code randomly”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
ac3f94f1e21a87807344e805533b9b772d39fcf6685596d59268fd93f125fc3b
Signature (Ed25519, base64)
BO9vnoUwxc6pdOg5DXuzyYXFV0o8Y/4u4mljp3r4u6F7wQdx6jG3gq7QasPged+ZIMYqLJas6PYrK/Pr35XfCA==
Merkle root
c921242d78a65e026e3281000ec5ef04ef930758058c4fed3f79f3b5ef992cde
Merkle path
["ac4236fb7f0c40a411a58a2b7554df47934f79403a894fd362f76ac8a5463d32","5e8e54bf297d8033d6ea7aac1834d6557a34b7eec8ea1a2fd08d0bfa817c48e9","51afa601595c88fb973ac4b41ef969d80819c41489c76153ddd4481ed1b2d360","87dd1939bfcab1583d792323f30458011e7ac21e107487b623f488eae734e50d","22ac0cb8ba955a04470763e33913f3f79436b309f4ed75e48bc34d26246563a8","327137f07c953ce69cc15532b8f2ecbda2e2cc45af023e4d801807cc356c66a9","5993781ef1de0d9cdce446b7232f50a71845b741bd80798db2ec579796b5e5b3","c83f453314305ca61354f3c95114f4fca3ce90168c292225c08fdb4e569e7a39","8329c991fedb628ae4daceefd0dd99f0222cfebc1ce18de4d9ebe4207ccf4ffd","231bbea28e6266249d9db14b3a926d3ecfb031e5f395ac48223d459aa7e35c35","5711f12bbaac91696c74cb6b3b4994068b4497f303a00bab859a9bee597e6a0f","8825fc1aab8f63f0e76e56b09417c2ae382071679d3b00197c62c53fcee32b99","dd9ac1ec648f41d4f9192f9ab4a90e9984a25e2b4db00816e217d361519f5150","11c55b906d5338fe2597d0d6abbdec07bcd15a81c2687346b92acf8d9db0c2f7","522d5a6bf348351e5632579ca190fcb390464957ba4b4698b399695ee13b67d6"]
Anchored
2026-08-21
Public log entry
search.sigstore.dev, log index 2543700701 · entry 108e9186e8c5677ac7e1…
Expected log hash
c1abaf0323b08bce2cedebaf1993162920ee741ace8973292e7ffdd13aca356b The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787287374804","kind":"published-quote","locale":"en","page":"brand:worldline","quote":"Needs app pin code randomly","rating":4,"review_date":"2024-12-22","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=eu.softpos.softposwrapper.wl","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c921242d78a6…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.