Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I uploaded the same document 4 times, and I kept being told that the document was required.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
ff86bede3965ea4defc8d8e022a504349142beb9c15d08b13f03fa7955c45678
Signature (Ed25519, base64)
k9RdVb9FLm6hlPuXxnP/Hw0kDn/GMsx1vPFxCzGolgqglTjf/pQTLuoaDyFmbxjXepl3ifs9tgj0T7ISh4ZZDg==
Merkle root
a893faa173c6b378c8d050262e841ab57fdd89b71985eabc0906c40abd5b6a6c
Merkle path
["ff7fe4a6e34d531ea8f3bc4535c5dfcf4689e67921d25a81e29c7ae2b2b7edbb","3f3430f113e26460b74bbbca534cbf1f624a81ef7740243717b0e3895a9b0701","df75f0773400f0b056608f5b1a067f98e3e8ad81ddc182ecf2e05889dd5e7ba6","4d896c90fe5b04668717828722047397b24ee531ea93c6f7d80c571ae87110e0","98ba3584953c7b1df4bdd9087d0a05daf9f1be47d7eb3b0ba00c4cd39304df8e","9ea1378d00b5c6b99f62d9afc51a623c8fba3576c70457bc748c0f0a8facf494","ebbbd480b0c9668882bb2c2f2976e7de9522e09f491aa381c60e4b6603bf0bdb","7eac25dc6ff86fa26a152fe942b86f262cd61d982c0ac57728706bdcb8fde98b","f60b18a98a1584b9939b45c2d8c6604cefdac1d8769c51aa71365c0ec0b2cba8","81429326a3806a2c63f015ab022fccfaff957d6c50fbb18750ec2dffb3e479e2","1fc33f42dc35de199363a0769df48782d994933f89f7e5730f05c9bd390125f6","142316fcc45d8fbb9a33df6e9be8f563650927c4e612ee96d4bcac9064ee60c4"]
Anchored
2026-09-18
Public log entry
search.sigstore.dev, log index 2882354328 · entry 108e9186e8c5677a08a7…
Expected log hash
5510a497abfe2e680a39c301b0d905c2a575bae0a1f389fbdd7b86babf05240f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1789619628558","kind":"published-quote","locale":"en","page":"theme:taxfix/service/en","quote":"I uploaded the same document 4 times, and I kept being told that the document was required.","rating":1,"review_date":"2026-09-07","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=de.taxfix","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (a893faa173c6…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.