Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“trying to cancel is just as hard.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2904877428

Proof data

Record hash (SHA-256)

ad9ead870bbe2a7b876af29c3078d39ea228357596a6a7be2b88f21845a29981

Signature (Ed25519, base64)

9epjP1+UTg5z8WIwIXgOJK40JHNOFRxG56EeJXIavMoHo7OiHtelmMds+t5v6UGUhewz54Ocis1XUqGrYzc4AQ==

Merkle root

e299bf38720a5a91bdf63bbc0205245bccdf3432ab1652c69342549658b7a9ef

Merkle path

["ad9d45d51561b7ea7d548e4b169db102242559a56e61719e5c14d6a6c14ca58e","3c4836df080c631f869f1a2eb21e25884f89f35c800cba977c320dca3517fcb0","438ef8d2c5cf050038d73f469fb9badc465b2df4f937670d88b9d674afc6995b","a1fee16b909d4e7d9689a6de3ee337ebf81b2cf36b9f8caf817322474f6acdf7","b9d8dee612585ef843c051e7fe5b4ce3f59f3608f89fe837950f05f8aaab8b41","2578ac4b553bdc138ed5723c081d04ef25910f00ff7285e949f937b841e0c63d","275ba55f2e16c822f360001dd4f73c36679201d3f142728138519f0ab0026330","85a3974a289f2609711740911e2e42ab1b64e6fcbbcca34ca596071c44b7a53b","9f89ed4d29e80d1c2592637356daf17400153a7254e51be2c94b9a018e7d20c1","1bafec4716fef44aaa0a9b422d633a061ee70c5aa832f48516756ee24a761c16","c5b7e137a8013a4a21c1d5b67afcd303b0734422cc0c2253880dfe8a42a53397","6c2612f525e9372e44b0deeb0737e4e68d621df2f62b7144b07119251a9b517c","b5d03b72964f911025dbd61c2eea673598b47768b7619e9a279966a44a138147","e3714293de39ce3c6e3cb9d5ea7711343b19d2be532c75504682d8ef52e8f91e","2a462314156907e42d6f0d96eed96123f1d79516aef73ed189d9f5466556b638"]

Anchored

2026-09-21

Public log entry

search.sigstore.dev, log index 2904877428 · entry 108e9186e8c5677ab408…

Expected log hash

d020708737f55ccdf49203f373fcbcefe8158cc388605556fbfda3c365de7360 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1789881486272","kind":"published-quote","locale":"en","page":"theme:xero/returns/en","quote":"trying to cancel is just as hard.","rating":1,"review_date":"2025-08-25","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xero.touch","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (e299bf38720a…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.