Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Keeps asking for my email address.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
f3585d58557b600677dc484420f62571fb9ec186251f83b4ff0cefabcc5bc5b5
Signature (Ed25519, base64)
Jtc4NoEcXiK2AWXfftuWVh6R9Xp6nfbCtUOA6Vcx2i2QnYWZtYu3LBzDRrMeCXT5SlEzXFvCglahJxGJa8NgAw==
Merkle root
61203b6d05350adaaef087cbce75d25fa5ac2036c1a66344255fc73a224d39c3
Merkle path
["f359d81105c4fda39a0a5477c2ec607becb3b364d85994d4a76654c26dd4a4b3","99afcc62553a434f7a6f0161c53eb638c4aaaa388e48ee72abfced5f7e0b5c8c","ef0b1209eb98c0ff4e6e5c84cf7c8f1a88303d53d544d7250f68ff4a3f25d269","b56b17ea457b28ea47e2789ad4a367b3f1e20cdad9bc8793551d76179c2d16a9","061a0ca02a50b4e06cd96fceca8c97a0fdbcaec53148a90529800d87bc147611","af9775649005d17af8e7f61222b31762123269c65891d45d7dbbe83fc689a36d","f5fe9070350bbbdaa668f87a13648c299d8c709cb4c124a9f9b79da6ccf25957","b1cd1dae9f85887cfa004ca933f2c3364c46db4735bf64591921a4ae47c5bf5c","92b4633f5d362cbf007b749de5a72896e0e24f89b0c366c51a0cd5f9750be162","ab28753ab27152038e3541bb94b11caa709f2c6d82d0b02956aa0dfe40cdbf4c","a9398817911c28db75b579ac4f057798d7eae45d292d15abdc73f7ad3c9ae407","7c50652f37df5f604887c0b116386ec670256bdc43ffc218a92e95daa62d4728","103940001013a47f10aff0c6330ea248cabd3683a28a117b8a46cc0a6c9062a1","fb12d3c300b4d1b1623e9522cd86e623211374da9dfa56f64ff24f713c393afa","2510f720b3b91a4799a8e500c87cce52153f0727344aadf519237b8a09b893a7"]
Anchored
2026-10-06
Public log entry
search.sigstore.dev, log index 3100032352 · entry 108e9186e8c5677abe62…
Expected log hash
0a0ca7b748f6c99c5a75a761289092bb11c807eeee08be8ec366fad5b0bfd2d5 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791253605372","kind":"published-quote","locale":"en","page":"brand:atupri","quote":"Keeps asking for my email address.","rating":1,"review_date":"2026-07-02","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.atupri.myatupri","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (61203b6d0535…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.