$ git config --global user.email "1a54d64db7e8beca6f2c6cd17b0cb479"

When rngcs verifies a commit, it extracts both the Git author field of the signed commit message and the signer identity from the RSG signature, ensuring they match. This binding is necessary to prevent identity spoofing. If someone crafts a commit with your identity hash in the author field but signs with a different key, verification will fail.

Once configured, sign commits using the standard Git -S flag:

$ git commit -S -m "Refactored module"

[master 8f7e6d5] Refactored module

This will create a self-contained RSG-formatted signature, encode the RSG payload using base64, and wrap it in an ASCII-armored SSH-formatted signature block. The signature is then stored in the commit object’s signature header and includes:

• The SHA256 hash of the commit content

• The signer’s Reticulum identity hash

• The signer’s public key

• The actual signature of the complete envelope

Commits are automatically validated when using git log --show-signature or git show --show-signature. The rngcs shim handles all verification operations. If any step fails, verification fails and Git displays an error.

To view signature information for commits, use Git’s standard --show-signature option:

$ git log --show-signature

commit 8f7e6d5c8f7e6d5c8f7e6d5c8f7e6d5c8f7e6d5

Good "git" signature for commit, signed with Reticulum Identity key <1a54d64db7e8beca6f2c6cd17b0cb479>

Author: Developer <1a54d64db7e8beca6f2c6cd17b0cb479>

Date: Mon Jan 15 09:30:00 2026 +0100

Refactored module

The output shows whether the commit signature is valid, and whether the author field matches the signing identity.

If you want to display both the identity hash and LXMF address for authors, you can generate a .mailmap file that resolves identities to LXMF addresses with the following script: