Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“The first app that caught my attention.”
Google Play · 5/5 · 2026-09-14

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3123908662

Proof data

Record hash (SHA-256): ed07de2d68933dd94cddd77ea688dc8fcf413f941b11325de08a48a50f6730ff
Signature (Ed25519, base64): UnApZUyVQsfZgoC5iQ1DdX3V5VJhBXcm0AR7LSA11cin8g7YqHSTkJbZhwcnPeQMjj9gsMq4HUFcMV7AkYImBA==
Merkle root: c53673589b1f41937342019e079ee2c0ad1635342b5b2a41cc71894367084fa3
Merkle path: ["ed078184548c39142e568f624bfcd7333522d68ff53ca1e745497ea4f6c371a5","d0da4de8ddf253306f48c221311fd4fc6e1184f1c5e8594c02c69285619976cd","62e818f0e4839ff118965aa81b21cb8c6a56f85cc3e66f51a39ad6e2895613f9","994b79305735d767b726a75d684ac62f05bc42f64d6c61312df0c8907911042b","2a6c305869063aa6ef660af4701f00fc44f2c6d7e2fe77e01d54aaca3db61e6e","8ffb26bcdf8095c9bbda992763ae84da93c21db6fcfd74286426c91f8a6988f6","02d926a891cec6c8a8d3df454c9f1b6814127e0eaefa05d48cfcf41a42e7b8ca","3b812055000136a436e67bc22252a560c46c6868bccc1083c736d51cf809fa98","3367f6b491d4f2aa56e31d8bc18f88db8ab16ac1846ed9e4cc6597329b95571f","611b1fe570afb33641fa8e5d86ec93591a2b0095a6b47e7dfb007c0ed03f9cf1","a4c24ea411c1146bcb0fd3ab6f6d96cfe0c0ce0733993440810de800a7e58356","6e463be5f42b16a166dbfda8feaac737cc0fc2b2361b5ec875292503df8397d7","7a50bbaa74dc72157cc791442bc1f4313c283e49c9af342f20608dd7e776cbac","ea816c3f8ecd74fdcdc9c068bf36a30dea5aa6d104e982532f9e8769ceaf3fff"]
Anchored: 2026-10-07
Public log entry: search.sigstore.dev, log index 3123908662 · entry 108e9186e8c5677a51cf…
Expected log hash: 5372e71f27172d067b5d688f48846b5317672647da39397abf474cf22aba0576 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791348381030","kind":"published-quote","locale":"en","page":"brand:quero-delivery","quote":"The first app that caught my attention.","rating":5,"review_date":"2026-09-14","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.querodelivery","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c53673589b1f…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.