Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Unfortunately, the app is no longer usable”
Google Play · 1/5 · 2026-02-28

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2904877428

Proof data

Record hash (SHA-256): c4c705209866a2b8993bfc2f71fcc4543e41aa17e8885e86e233067fa38b3a9a
Signature (Ed25519, base64): mhoa7rlUxrlIsRgvFn2P1H+riUQvb0dXIp1qP6rZY86IhgS/fOfoFw3O6hNaz9eVKYFsLTuiO0Zz5SwJNUeOCg==
Merkle root: e299bf38720a5a91bdf63bbc0205245bccdf3432ab1652c69342549658b7a9ef
Merkle path: ["c4c1313b180648511c5c71becd91e86484688d371f4b24c6ce51a2a4deb09ffd","4a40f3926118c6e757999dc24f9ad1a644a42b1f8a8209db94edb77b22f9d224","333a4e4906388806f14eea5b972013889a021ea43030874c1d5eaf1fefbcdb78","8cec06edbeed4f94aa5bf38e29bd4eaf503d5e086a65a0eca51fa03623c4d6ff","2e5447975f3e0e2cacaae238a7847ceedb8b1c876342c28ec0d363ccaf2749ad","971b2ad6bdabdce9d0c1871585bce81c9871b9ce786da8fcaf0982c04fe1d5b4","ca2e4b9919dbfb684f7acb45fe5b9718da534000dbda9b83ea529a14bea0aa74","21e3967e709ec4e277ca711fd931ff18823bed6159f8c8fd70459ea0ea582643","28881da0c7d16fa6b4fa906c9569211c5f2f373d893654dad67a1a5ee6f04f07","1be6300f4de405a747f7e363d932d28150c92bf4b0e69c1d57aed29293b15db9","c76744f61713b161c2df73a6eec773c0acb500654c459ab09b4f8ebb3ba40f92","1b051bf1ff36589fb2c3614b917f0b7f052e466f644868f148d61dc06ad499eb","06f94171d32c86f72a9e1d984f2a7c3fa7bd9f00a98eabaa3fbd7d57db71aaf2","e3714293de39ce3c6e3cb9d5ea7711343b19d2be532c75504682d8ef52e8f91e","2a462314156907e42d6f0d96eed96123f1d79516aef73ed189d9f5466556b638"]
Anchored: 2026-09-21
Public log entry: search.sigstore.dev, log index 2904877428 · entry 108e9186e8c5677ab408…
Expected log hash: d020708737f55ccdf49203f373fcbcefe8158cc388605556fbfda3c365de7360 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1789881486272","kind":"published-quote","locale":"en","page":"theme:v-zug/ordering/en","quote":"Unfortunately, the app is no longer usable","rating":1,"review_date":"2026-02-28","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.vzug.home","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (e299bf38720a…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.