Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“This app doesn't stay logged in anymore.”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 2514654467

Proof data

Record hash (SHA-256)

fb03d15c752200b3ed60949a245adc48656e0076c977e992c12f69f3e228ff71

Signature (Ed25519, base64)

oKli/FZUcBeRznQiubmfI1VLeWRbhqJSoGgf2cEUFPDbSGEBD6LOM+iJVA7tIiXXxbn0yP8huno7npoaURYpAA==

Merkle root

2030d4ef17fc68fad1320305cf569e85a00baea931fba0d3ebe628cf9c90c35f

Merkle path

["fb03367a4a4d92597a2c6adfb5c8591bd0c86b796fc7d0eb1afb78b784ea412e","cf816523674366b01b1063e3a80218f017bdc2b99f593b20a9b6bff530826c0c","471ad9d3c76cdb8cbd54e515403db79b97e049dda0a447e8676c252fa9c86d4f","c21c894413fdf0a6118a9f53979918da9c4a4c402dbd02b975d736458692e9fd","7d785342ed1d6b9be16238f868ece81f300d82c6d516ce726f37bd78b7997903","2774cf0c278d6588901edb478e3d7fb1f1eb98b06949d30996e9c88075ec4f2f","440f86c5b15ccfee8ba4fdfdbd85a93a9244febb896a2b0b25ddcf4f4cb94711","0c699a5281415641823f4f1c5006a0785077129ece2ef6e2451705157fc30117","cd363afcc0b58438db28a56b446c929e1934fb726289f31b9d26084d7d2367ec","74032dd2bbc6d75704d9634bf54d234e1b73367449b10e1c5625dd17c38abf8e","ba7d688cf7aa2553a6d16d39a57c173aa2a889c551139b3c5683169b12be5b7d","ac47b10da702a9479bd116280fe3e40eddfcf168ceacbd9cb725f508893ed250","20ea0d6aeaab7028adab5147f39d1ebf52355cf181354f5c166cdff8fc496c2e"]

Anchored

2026-08-19

Public log entry

search.sigstore.dev, log index 2514654467 · entry 108e9186e8c5677a9253…

Expected log hash

ddd8d6dfa3771a4106292f7bec674337dc9649465b28b118bb17bfc2b8ff0a67 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1787132872903","kind":"published-quote","locale":"en","page":"brand:signeasy","quote":"This app doesn't stay logged in anymore.","rating":3,"review_date":"2026-08-13","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.glykka.easysign","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (2030d4ef17fc…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.