Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Spotify is one of the most popular and widely used music apps today.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
af3cb2d64f3cb794ed35ce69718ec54ff0b7bf3ea69f500996887c9a2fafd119
Signature (Ed25519, base64)
z+cFttcGQJ1AzF6UP2VHsJX0jPmx+RBmg3tPC6kS6HRvmuEexdxqsl5MgkRc9RHKnAU6ai+/te7h/R0KxMvICg==
Merkle root
c53673589b1f41937342019e079ee2c0ad1635342b5b2a41cc71894367084fa3
Merkle path
["af3cef47b14400ed91a79becb1ada515ba03f43ca5f2447b061acdbafdfce498","4dc45a5849677634682ad83945eeaffb84db3d8f4e7371fb083145a0b0fb0ad7","407d20b30be77cf6bf9f098eb1423039a6e47a0590feb124953b910559bc9d57","89b7978c6fccccbcfbf8cd474b93fc7818e61572bc25873a1138280bf3d785c9","cfa53b3680d8c90ea411d96ef06e38dd1e99f505ed84fa04a8dcee599735e672","a3ca940c815edaf4b84913c5c4006a9e90316072e524cdd09e28125e37520885","5cac10fef097d46d3ff46f33a3d93a2fd51a2c80d96efe476cc17d4c02d667ce","b63a33b8f307bae352051c813098768f6f2dfc47f3b986613a01844a36ee0545","dd1af1b98ffcb7ed02e03b034227da5b79bcc858cfb71b83991535a251b74aa7","ff872a412d99f80d77699be5e329b08de973eba23fbd06890711619ebeffc7c7","eca30af202714f1df3839be11aa3b70d57fd9853a473df21a27e523cdc8aba3c","7d1064096d315df35fac08bd88c207823cf44d9f53462fdc3bce8eb6d1967a85","ac0cf0905b4c6b990aace09affc00130a5f0345b56a32b37fe9b0f0d56ecb1ab","7edfc85f9440fe7fef8e7edd6f1372271982f006f84b94693306aed78930ab32","ea816c3f8ecd74fdcdc9c068bf36a30dea5aa6d104e982532f9e8769ceaf3fff"]
Anchored
2026-10-07
Public log entry
search.sigstore.dev, log index 3123908662 · entry 108e9186e8c5677a51cf…
Expected log hash
5372e71f27172d067b5d688f48846b5317672647da39397abf474cf22aba0576 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791348381030","kind":"published-quote","locale":"en","page":"theme:spotify/delivery/en","quote":"Spotify is one of the most popular and widely used music apps today.","rating":5,"review_date":"2026-09-19","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.spotify.music","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c53673589b1f…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.