Witnesses

Witnesses are the security teams whose confirmations count. An advisory blocks installs only when 2 of these 3 witnesses confirm it, so no single account can fake or hide a warning.

Choose whose confirmations count

Today's witnesses are three testnet wallets run by the Mene team; in production they would be independent security organisations. You decide which witnesses you trust wherever you run Mene:

CLI: mene.config.json in your project

{
  "issuers": ["0x…", "0x…", "0x…"],
  "threshold": 2,
  "minSeverity": "low"
}

GitHub Action inputs (or use the setup builder)

- uses: andrew1234-arch/mene@v1
  with:
    lockfile: package-lock.json
    issuers: 0x…,0x…,0x…
    threshold: 2

Become a witness

A witness is a wallet that publishes and confirms advisories. It needs a funded Tiramisu testnet key (see the faucet) kept in an environment variable, never in a file.

  1. Publish an advisory in OSV format. It is written so it can't be edited and sealed so it can't be deleted:
    export MENE_ISSUER_KEY=0x…        # your witness key, from a secret store
npx mene-check publish advisory.osv.json
  2. Confirm (or withdraw) an advisory another witness published:
    npx mene-check attest 0xADVISORY_KEY --confirm
npx mene-check attest 0xADVISORY_KEY --withdraw --reason "false positive"
  3. Ask to be trusted. Users add your address to their witness list. Publish your address on a page you control so they can check it's yours.

Witnesses with a browser wallet can also confirm or withdraw from any advisory's “Verify this advisory” panel. CLI reference →