# Be a witness for the geo.qa log

geo.qa signs each answer and adds each signature to a public, append-only log. A witness is an independent party that checks the log and co-signs it. With witnesses, geo.qa cannot show different histories to different people without being caught. Today the log has no independent witness. We ask you to be one.

## What you run

One small script on a machine that you control, with your own key. It needs Python 3.9 or newer and the `cryptography` package. It sends nothing except your co-signature.

```
curl -O https://geo.qa/log-anchors/geoqa_witness.py
pip install cryptography
python3 geoqa_witness.py keygen     # once; keep witness_key.json private
python3 geoqa_witness.py run        # then every 15 minutes, for example from cron
```

## What each run checks before it signs

1. geo.qa's signature on the current log head, against the key in https://geo.qa/.well-known/geoqa.json.
2. A consistency proof from the last head that you signed: the log only grew, and nothing old changed.
3. Only then, your key signs the tree size and the root.

If a check fails, the script signs nothing and prints ALARM with both heads. Keep them and publish them. That is the event that a witness exists to catch.

## What else you can check

- Every hour, geo.qa stamps the log head in Bitcoin with OpenTimestamps: https://geo.qa/log-anchors/index.json. Check a stamp with `ots verify` or at https://opentimestamps.org.
- The co-signatures of all witnesses: https://geo.qa/api/world-model/verify/log/witnesses.

## Contact

Write to avijeet@vortx.ai with your witness public key (the `keygen` output), so that others can check your co-signatures.