Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I prefer it to the GMail app which I also use.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
dbd5901b6c006c9de80cf9ab32548a828abadbe1e35c802743eb2a39fde100f7
Signature (Ed25519, base64)
QCB/KF08sG2+6Tmrp63IOJKsnZ/NUXuDuQQmWO3I96C0qAr5MUI98B/6fA0x64fPidpWrDiQnWtJNIRXfL2pCw==
Merkle root
1b26d1b85473caad1868633ec4c931eb970e81199eea87926818f3f1753af37b
Merkle path
["dbd6d6756002b1dec1e101683a65609bd415d0549dcfa9ca47e9b7fc4c7a4283","9e4db48e7fe39938b91e2ed2ccf6b9cc992509635ac1a4b4cbf12b088c5553c2","fb7c373b100e9bb84663a91839a4face90c4d51f7742d376e8d0d0034b8c2d08","295eef49af2ebd7d5464aa51270dc390f774198ba911f23732891d6da7b2e15c","6cc3a0796e1fdcf4cb3c3377cef89e8391ba4a2f40704cd9eee8671ab53be64a","32784c340c91dafb2b4a6bbfe1fbc9882082920ee65c9a84254a67916cfa9b17","e381933a3d8d42eef97ee56b8b185c15d1af79628cffc59a750334bbe4e0fc49","1f0664a79fbdda83172ca8e0253efd3f392485c11cda3fc6919b569dce4e9697","78bb763fdf0ae98e2b87cc828793132c65eb03e43a2e9ebefabac26088bc1f1f","70203f0bb581cd486ff797a4c292657a71441851b6ffb8f86cd4707076b9e910","473bd0e4b9cd2abfc3c5be9df38413ab7910b5346eb6b8ce3afc90d987956108","7a24fd993e3bf84eda272d8736103975938ecdea0a4735f7dd20272e5426c081","a6a0da628b07765cd60760418523562175762beaea14b25d9c7e86ae845ff868","960bf22ef55c7546ef19790851db978b808b1671c1796ebb940f67a9b4011141"]
Anchored
2026-10-08
Public log entry
search.sigstore.dev, log index 3138947147 · entry 108e9186e8c5677a2712…
Expected log hash
8f66b765b7efcb11dcdcf57b81c46ed3317a5895f5b870638e23b76f1efbb2d5 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791425549743","kind":"published-quote","locale":"en","page":"brand:fastmail","quote":"I prefer it to the GMail app which I also use.","rating":5,"review_date":"2026-09-04","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id931370077?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (1b26d1b85473…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.