Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Doesn’t sync across devices reliably”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
b8f871adf9fd121a413591e87212f4977d23da1ca064cb1a3763cd0ec9065c43
Signature (Ed25519, base64)
qyo3NKT79P77HHGR/XleM8YsA0jRs9kEZGhmqctsGeqztblmiqZLHNm2LvHeo/WyklQsOIr1snVLFBS8dk8ZAw==
Merkle root
1b26d1b85473caad1868633ec4c931eb970e81199eea87926818f3f1753af37b
Merkle path
["b8fcb95aeb446d18bc9f33408cd29ab6a604f53c1766b0ac34b36ea0c872899d","9540c7191e8a450aa19a1429d5fdea8cb68b41d02f37a42afd9d596abcedde2b","b2d80a2dcd9049fe86c22558fc58e1c0021a8955d34756c7fd577de0678665fc","60b5796f42c7e44ec084f3d34de9e5d35ff4f2f83c7a4e30944a387267455b1d","a5a8dbf55732655277f34eadd718c1160c05f405ad369f07a56535d9b2383b92","b5f6a2508e2a4bcae6c397622a6024045f55215a7f0e6548767f33a845df37e0","e73be9f91b5869033501085b10411c7ce748767b36e690bf9eb65a0d20dec4c2","af08c17968897f278f014b474c2d5e4347588ac4eec214cfce501565f601930a","dc789bfbb34fa4d72710bdc5a3f7c85055f19310fb28a2701916bad1766478e5","f7b2c171c542070129cb45a947ea55ec23a9700f899e3d5af7af4ae6843d962f","1fe8a9ea53f8a8cbc48f25d9b08f8cb3122cb6b812c8e0035d39eb7cc3d49e24","0928ecf88354927cf77248647655f6a8bb07dea2f6f4911e0f34fbbcb0f1ef7a","c0dee208cfc82bb58ef8bfbdce70ae59669cc0fafa6229438e70014c20ddc06e","f13bd3931ffab245c82268d5388ec4e7a23a41a86394a369b97f89216cceb3ad","06054c91b82ccf7b99bb6b4fcb7c60afa97f93295e6829b75e5bf1efe9493e63"]
Anchored
2026-10-08
Public log entry
search.sigstore.dev, log index 3138947147 · entry 108e9186e8c5677a2712…
Expected log hash
8f66b765b7efcb11dcdcf57b81c46ed3317a5895f5b870638e23b76f1efbb2d5 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791425549743","kind":"published-quote","locale":"en","page":"brand:nordpass","quote":"Doesn’t sync across devices reliably","rating":1,"review_date":"2026-09-04","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id1486322860?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (1b26d1b85473…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.