Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Aktualisiert, deinstalliert und neu installiert”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
cb1a221ddecaedf5e25217e8957471cbdf16691905553b21819b8280d28a44fe
Signature (Ed25519, base64)
J5gaNANcGFOddPjW5wJmhXl6QkGN+3nEH3d7hfQ/tTDlH4pADuFT76lporp590i1Vzxn2AqR1Eqx+ItbjALIDg==
Merkle root
8286585306e2f6535f24bc74a0e420351a30ee784970721b6abc81509589dea1
Merkle path
["cb15dacf1e3d1338edc55da610e3ef0a1b36f7266e594f3d38cc84fa4fc506be","8e405bf88a72603e7698d76181eff8f2a723c4fc3944d48393f0c0bdc907aa18","92d054f3d042be91ef0b08d99db3bdb25469368f2bfebdd52d1d3420987c584c","b30c44fe2d9b17182a6f18b0f736853c367d5f14f6080825fd8b0becc0852c1d","ca9a8623f2ffbd295457f9cf245d71de481097ca09ee434cf2430baa52b6c765","7da6379e7cbe50fa7e82582a7a484eddb290001194b6693c14341b7922892ab1","bf5c703e883a04109d5dde1e602d4dfde4670971b5ac21191bf433356cc8f7dc","1d86a898cf1564d3c3ca05c4b834416fb7a346715ed2f39da720f3cd7aa6d804","67e5f4a6bff226fd8d3b884b97544224e87051ecdacd6e118c35412a5d961583","06dc975065372d4486fc3addd7f6b3a74a2db43ef4313ac7d9b70fb021824ed7","b06cc7c2b68b5f164737589005a4503f1fb762804021ec974cf8965ce85c3332","dd775cd2ce3b7bf7dc1ecbe16f3136af2246898ca6aabc271f1e0fc081c37c5f","1bae7ac969503874b815bcc29390b10cbbdc3eb2136b8bc2143a88dba5a1962e","ea030a4ef20ab0c5d888bc73d3c4b4bdf60ec441cf37d16a7f8b19888c38b246","9d207bb1c21ea0ead25a7a9399810567acc6ac0b2f8564a35532517a2435432b"]
Anchored
2026-10-05
Public log entry
search.sigstore.dev, log index 3083089221 · entry 108e9186e8c5677ac51b…
Expected log hash
74b336b309bcff3112628e1f4c16da8950920df5b515dca6ef51f80bb0b0d24a The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791179522617","kind":"published-quote","locale":"de","page":"theme:spotify/fit/de","quote":"Aktualisiert, deinstalliert und neu installiert","rating":3,"review_date":"2026-09-20","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.spotify.music","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (8286585306e2…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.