Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Not sure what they did in the last update”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3083528439

Proof data

Record hash (SHA-256)

ad06fc26a0049548960714d89193d3e8d371287aebc016147e884490a8870b52

Signature (Ed25519, base64)

hfWtEH49iZ3AzeYHGvwhTgJ5qZlj+t+3Mgijwc/EV6cSR4Dgc8t1V2gIyfNYfiBrXNprR5gqMzJlRjm5s3ZSAA==

Merkle root

3ac2a65164a98b25d6607e9cd20ce9559bf4391886ca2eae943b9792fcb8a323

Merkle path

["ad07adf6b2cb0c11e5898836979185bd378f5e2603e7670529549cec09267c62","87c433d18a85a753941c4eebc76eecededd173863cc7f019e31cb5c0ce2c8a5e","f6bfaee2b99153643d9d95b00b79f179408676b6a17833e9bbfd7ac09ab8d869","8fff407b57a4f35ef253a609334e2321d05060d06ad8a50bdec7f0e68a57867c","b907bb815c91f49f6f90196cd60a447ba676a786fd8a87364d2d89cbd3ea8039","5ef03ec076fc9cbc6a73ccb8ba3a526c4bf1c4f73683fc5ec76cfcfabd01bcfc","b53d5a487410a01ea9cad9da68f505f524539e83b3b8bb75f0a932617e71d62e","96f4597b781b7b30bb64695287adbe4a86d3ebc49bb2c83017be3bdc8eeedca2","9ac026e88b57ccada0e1fb92508b5762db1d1731cff05d758e357c22e43a247c","005bf889aa9064757129877caf1bc4703773ff90c0c1dca1121c5363445016b3","500f931195128186fc5378bea8c8ab0fdc1f026a843389e42032f59e24c8b7a4","008ef998ed6dd9f3799a6840f0ccd06853f8c33568d99343c1fb34c4dfe62a94","9bda89afb801a1d22cd8905589cd5237ad4f295b6954329d6c8a92352a1f2d04","582f0970476bda674580f5a1da0cf4286664f79c3451840f238219e2e601200f","f188a7ba649f7db7610333505ec2abb71ba1da1ea59f53190cb32e51e57ac1c2"]

Anchored

2026-10-05

Public log entry

search.sigstore.dev, log index 3083528439 · entry 108e9186e8c5677ac4c0…

Expected log hash

8816bf48c9e6a0b1ef2758b04fc7021824819cb4cee30b879cd603a10d38b8a0 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791181418024","kind":"published-quote","locale":"de","page":"brand:anton-paar","quote":"Not sure what they did in the last update","rating":4,"review_date":"2025-09-30","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.antonpaar.homebrew","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (3ac2a65164a9…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.