Witness an election

A club nearby has asked you to help keep their election honest. The favour is small: a few times a season, this page checks that the record they show you is the same one you saw last time — nothing rewritten, nothing quietly missing — and adds your signature to its fingerprint. That signature is what stops anyone, their own committee included, from changing the past. Five minutes, nothing to install, and nothing you do here is sent anywhere.

CANNOT SIGN HERE. This browser does not support Ed25519 signing (WebCrypto). Use a current Firefox, Chrome or Safari — or the same witness in a terminal: proto/clubvote.py witness.

1 · Your witness file

Being a witness needs one small file. It is two things at once: your signature stamp, and your memory of what you have signed so far. Make one here — the page gives you two downloads: a card to hand to the club's committee (that part is public), and your witness file to keep (that part is yours alone).

Done this before? Drop your witness.json here — or choose it.

First time? Just type your society's name — the page turns it into the technical form the tools share, so you never have to:

Your society's name

Your society's website, if it has one (optional — makes the name tidier)

The committee gave you an exact signing name? Paste it here instead

Two files just downloaded. Hand card.json to the club's committee — it is public, and it is how their election learns to require your signature. Keep witness.json private: anyone who holds it can sign as you. Your signing name is — just a unique name on the paperwork; nothing on the internet looks it up.

2 · The handshake — once, in person or by phone

The committee gives you two lines to paste in: their club's name (in the same address-like form as yours) and their record's public key. Take them face to face, by phone, or on paper — never from the email that asks you to sign something. The reason is simple: a request that could introduce its own judge would always pass. This handshake happens once; everything after it is checking.

3 · Sign their record's fingerprint

A few times a season, the committee emails you a small file: witness-request.json. Drop it here. The page checks four things in plain terms: it really is the club from your handshake; it really was sent with their key; the fingerprint really matches the record that came with it; and today's record still contains everything you signed before, unchanged. If all four hold, you get a signed slip to email back and an updated witness file to keep. If any of them fails, nothing is signed — and the page tells you exactly which one, because that refusal is the whole job.

Drop the request file here — or choose it.

What this page cannot protect you from — said plainly

Losing the file: your witness file is the stamp and the memory. Lose it and this witness is gone — tell the committee, make a new one, redo the handshake. And anyone who holds a copy can sign as you: treat it like the society's chequebook. An old copy: after signing, keep the newest file. An old one still refuses rewrites — but it remembers less than you have actually vouched for. This machine: a compromised browser could sign something other than what it shows you. The request and the signed slip are small files anyone can re-check with the command-line witness (proto/clubvote.py witness — the same witness) — and two witnesses on two machines is the whole point of asking two societies.

Part of the Civic Kernel prototype — the architecture · check the election · cast a ballot. Interchangeable with proto/clubvote.py witness: the same file, the same co-signature, the same refusals — a parity test in CI holds this page to the Python witness across a whole election.