Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“if I blocked the connection to internet of the app from settings, still it send data to your servers,”
Google Play · 1/5 · 2026-08-01

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2515439294

Proof data

Record hash (SHA-256): c077c8632df6e76314b2649a1173557bb434fcb28a627bbd7f19e2eb895a598d
Signature (Ed25519, base64): oArGP9EIcFJGDLFJczoJ/7Z0+zV0dkDyyYgKVCdS5voBNG8XBI54uwZo7YlM7iJaidvmtiukJKVoot/qJ7v6AQ==
Merkle root: 8c6268a14330d1a3403c561e774645b0671f81571ec1735d4674ebe1de7502e8
Merkle path: ["c07787f4b9b8ec394387c063db888e582da5bdb7fb5f64ed880f4b1dc359d2b6","acc6c24606aa3a5f890f362bda27031216b0bef59d5bfb8bb89c66cbb22efb8b","e691a606cfbc514fc561694769bba6db1fe4b3e5078078120649893c8179625f","b23d745ac548eeadd61490a303950c2d4debf9348ca620973068b59a9d968ee8","f518d4b99ad7ef47f7c60ca84f0510b94810903fd503d6bd49d1aa91f446055f","687aab0d7fb12533c82365e2eda5755c6514188968b292f2e91215f628a66b7b","37a9f71cd4819146360726814f374a91856454e6c7753c090b9dc4c72cd2a231","d1e072eb726293972832eaf3827d86442aa4d1c2fae3ccdf3c7f344cdb924f70","11679b46fd83ff7f1988e71c04572e22c0b70810d439b743630dca01eddd1afd","bf2b8268704c3f444c9c2420cf7be778538df6bcaef5a778d1db69abb17309ee","2d713cd4879aa54c8b4f8e8180645d287b3b7108dd3a6b07b54fb049b1e0439d","46547533536c23b0cb9fe347aab73c6bf8b07ddee2809398e2cfc721d5951813","c483df2db2ba0256789552c7244a58c96a87dd33342e2eb560908ca98074e6ec","2de97363b84c3a3c7892d6c13559facb127180f7fe51ea764f30fd45ad533e91"]
Anchored: 2026-08-19
Public log entry: search.sigstore.dev, log index 2515439294 · entry 108e9186e8c5677a4f15…
Expected log hash: 128701fddbb19410bf57cdb2d04d7a0278d13bcfda6410d76f176fa58341e1c9 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1787141082461","kind":"published-quote","locale":"en","page":"theme:xodo/communication/en","quote":"if I blocked the connection to internet of the app from settings, still it send data to your servers,","rating":1,"review_date":"2026-08-01","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xodo.pdf.reader","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (8c6268a14330…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.