Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Confuso, não tem como fazer o Pix com a chave Pix do app”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3126883925

Proof data

Record hash (SHA-256)

f0d8134849dcbfcfe3c639f814144b6e44281034e36e20cc6beb2439438c02c6

Signature (Ed25519, base64)

cTXls3AXtwN4nY4nMgUeaVPh6dlVgptRmYdAY6hQWJZksDX73MaRxfQTJO0OfF1esLP/GiOhv37e8px5TXPbAg==

Merkle root

0d7fec37eb7aa7ca022c461398d36283692153bdca7d5292b2302abb6878e5f6

Merkle path

["f0e3becbe304d67b4a9bdf1e0a1f0ce12448c50d2fe3689a4b3fca3ee796210c","edd81b58d5104675cf0fc0d2d0a6bdcc6726db8c5823b7f7e275f82af78c13fc","8958a63a25b8800382653d2d7aebd9063bfc1377acef369e561192e76b1379d0","964d873de3915331077d341c9e41ba6101168d22c64a7c577761468298533da4","99bd4f7a295abe8953242e70b7a1888b800bc3c65e974e970b9f3729987817d8","e4c5e05d423a1e6a745b9bf5ea83ba814fa568470e4e4af3c3002d5fb0f18b30","a04470bee976b39a9cdf0481dcf4784f2001b5c4257804f91c94a065d456e03c","16bba2dcbdbc0283ea27c846bcf20f2a8818b89291b189b875df1ee30be33d49","7a6a1f2122da6743dc5374607f39a0bfeebc73cef433957c245e2d5bb97f85f4","213da1c68242b0dd514321294220b6b8a3c2d31939cdd8320a8ecfa824b3311b","bfae64fedbff69ce3121a48c0952ddf30fcf428d2431b245c9745646029f2830","0fa3a575da66b503a77291657846b5daf13a9e496754b0b1e8eea48517292775","956e9e262109df10194605d76388d273cbe98f6754d203b26bfbcbec8d5e6b13","a5e4945621803ecfaa28b41399735783919e0518f2827e7f6aa82a6ed0687d7d"]

Anchored

2026-10-07

Public log entry

search.sigstore.dev, log index 3126883925 · entry 108e9186e8c5677a6678…

Expected log hash

7790667e260445bf729ea3061132c2116b163a0e0b944eca343c9e8408350ef6 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791359818972","kind":"published-quote","locale":"pt","page":"brand:uairango","quote":"Confuso, não tem como fazer o Pix com a chave Pix do app","rating":1,"review_date":"2026-07-07","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.uairango","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (0d7fec37eb7a…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.