Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“App update”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
e9e865b8e27b660003e6f97c9fb25cc56a6348495b17980aec494a1874688835
Signature (Ed25519, base64)
K8ZnKTWLgPJsrPeul5PgNUd6ffPHFFARONi5wHjmnbA1VdnTtPPFRSjlncBGoiGfLHBNB6Y3ulp8AOCy8RtWBQ==
Merkle root
61203b6d05350adaaef087cbce75d25fa5ac2036c1a66344255fc73a224d39c3
Merkle path
["e9e8e7b84c78a03b963f65b3e1f702269f77c808d60175029963de07056726d2","7b853ca7295e6d95a7df26100a95ea16f509c77b93be018089b666f0336db80a","245934488fc253490fc31d7e2fe2ee0f4264936442eb3cae6a22d770034e507f","6050626219d980455ce8a9adf71c8f19438196b4a41969e0d7920fab2b4b6b0f","500112785e5263a0fd69f7d87cf925c917eb3033d994dcb8a85536cc85a291a3","78acfad3726bf8b75b6dd778b34ca02d35ea7d675c1cc905d46302a8f4edc6ba","f852d45dc009861085dd54775861253a0f615c0c7580d0e9f6a7263196118085","4933cf87fca0b07a36e7e39e24e30ffbd5799e859de602f1c85df2e26863b296","7b97a0b01930246924ef20d429d3eb30b1b9ff9975aeb78eff4ab7a19acbe8d7","6c0855ff7c857a55fd441c391d64336f616a9bc68b9eae9bb059c41d659a828e","71416f86bdf8b28d1596fb143c0724739de4e95ae0c67b2c5bca73f01eeb5ef9","7c50652f37df5f604887c0b116386ec670256bdc43ffc218a92e95daa62d4728","103940001013a47f10aff0c6330ea248cabd3683a28a117b8a46cc0a6c9062a1","fb12d3c300b4d1b1623e9522cd86e623211374da9dfa56f64ff24f713c393afa","2510f720b3b91a4799a8e500c87cce52153f0727344aadf519237b8a09b893a7"]
Anchored
2026-10-06
Public log entry
search.sigstore.dev, log index 3100032352 · entry 108e9186e8c5677abe62…
Expected log hash
0a0ca7b748f6c99c5a75a761289092bb11c807eeee08be8ec366fad5b0bfd2d5 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791253605372","kind":"published-quote","locale":"en","page":"brand:delivery-much","quote":"App update","rating":3,"review_date":"2026-09-24","source":"Apple App Store","source_url":"https://apps.apple.com/br/app/id917686123?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (61203b6d0535…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.