This guide installs the TrustDID software bundle on Linux. The binaries are statically-linked Go and have no runtime dependencies. There are two downloads:
- Free (
trustdid-free-linux-amd64.tar.gz) — the verifier only. No account, nothing to activate. - Suite (
trustdid-suite-linux-amd64.tar.gz) — every TrustDID tool, for every plan. Your plan's license decides which tools run, so moving to another plan never means a new download.
What's in the archive
trustdid-suite-linux-amd64/
├── trustdid-* The tools (Free: trustdid-verify only)
├── install-gui.sh Guided installer — the recommended way in
├── install.sh Copies the tools to /usr/local/bin (+ systemd unit)
├── uninstall.sh
├── nautilus/ Right-click menu for GNOME Files
├── manifest.json What this bundle ships
├── README.txt
└── INSTALL.txt The plaintext version of this guide
Step 1: Extract and install
tar -xzf trustdid-suite-linux-amd64.tar.gz
cd trustdid-suite-linux-amd64
./install-gui.sh
Enter your password when asked. The guided installer copies the tools to
/usr/local/bin, installs the trustdid.service systemd unit, adds
Sign / Verify / Encrypt / Decrypt with TrustDID to the GNOME Files
right-click menu, then walks you through Step 2 and runs a self-test.
On Free it stops after copying trustdid-verify — there is nothing to
activate. Run trustdid-verify FILE on any sealed file, and skip to
Next: install a plugin.
Prefer to run each step yourself?
sudo ./install.sh --service
trustdid-setup --managed YOUR_TOKEN YOUR_ID
sudo systemctl restart trustdid.service
trustdid-test-local
(sudo ./install.sh --prefix /opt/trustdid installs somewhere else; add
/opt/trustdid/bin to your PATH.)
Step 2: Activate your identity
Your enrolment email contains a token + ID. There's no license key to type
in — trustdid-setup --managed generates your keys, publishes your DID, and
pulls your license from the API in one shot:
trustdid-setup --managed YOUR_TOKEN YOUR_ID
The same command covers every plan. Whether your enrolment is a professional or a business account is detected from your token, so there is nothing to choose.
Joining a business as a member? Your admin sends an invite email with the
same one-line command. It generates your own keys on this machine, publishes
your identity under the business, and stores your personal token. Shared
profiles your admin grants you (a #finance signing identity, say) arrive on
their own: the service polls the business every 15 minutes, or run
trustdid-setup --sync to fetch them now. The invite works once and expires
after 7 days.
The setup writes:
~/.trustdid/config.json— your profiles and service settings~/.trustdid/identities/— each identity's license and token~/.trustdid/keys/— your private keys (Ed25519 / X25519 / ML-DSA-44)
Your plan and the Suite
The Suite installs every tool, and your license decides which ones run. A tool your plan doesn't include tells you so when you start it — for example "Encryption is not included in your Starter plan" — with a link to compare plans. After you change plans or renew, refresh this machine's license:
trustdid-setup --pull
No reinstall is needed.
Step 3: Check your setup
Run:
trustdid-check
It validates your keys, configuration, DID publication, DNS records, your license, and any configured trust registries in one pass, printing a line per check.
Add a registry you trust
Verification answers two questions: is the document genuine, and who vouches for the signer? The second answer comes from the trust registries your verifier consults. To add one:
trustdid-setup --add-trusted-registry REGISTRY_DID
Use trustdid-setup --list-trusted-registries to review and
trustdid-setup --remove-trusted-registry REGISTRY_DID to drop one. After
adding, trustdid-check re-validates every configured registry — it resolves
the registry's DID, probes its TRQP v2.0 endpoint, and reports whether the
registry is public or private.
Not the same flag:
trustdid-setup --add-trust-registry(no "ed") publishes your own claimed affiliation in your DID document; it doesn't affect which registries your verifier consults.
Step 4: The service
The service backs every browser and email plugin. The installer set it up as
trustdid.service, starting with the machine. Test it:
curl --insecure https://localhost:8080/health
You should see {"status":"ok"}. The cert is self-signed and only ever lives
on your machine — --insecure is fine here.
Check status:
systemctl status trustdid.service
journalctl -u trustdid.service -f
To remove TrustDID later, run sudo ./uninstall.sh from the extracted
archive. Your keys and configuration in ~/.trustdid are kept unless you
choose to remove them.
Troubleshooting
trustdid-verify: command not found.
/usr/local/bin isn't on your PATH (unusual), or the install failed. The
installer prints the line to add to ~/.bashrc when the folder is missing
from your PATH; re-run it and watch for errors.
A tool says your license is missing, expired or doesn't include it.
Run trustdid-setup --pull, then trustdid-check. If the tool isn't in your
plan, the message links to the plans.
bind: address already in use on port 8080.
Another service grabbed it. Edit ~/.trustdid/config.json, set
service.apiPort to a free port (e.g. 18080), restart the service, and
update the plugin options to match.
The service fails to start.
Make sure you ran trustdid-setup first — no setup, no license — then read
journalctl -u trustdid.service -n 50.
No TrustDID entries in the GNOME Files right-click menu.
Run nautilus -q and open Files again. Right-click inside a Files window:
the desktop is drawn by a different program that doesn't load the extension.
Next: install a plugin
- Outlook on Windows (if you reach Outlook from Linux via Wine or RDP, the manifest install still works the same way)
- Chrome / Edge
- Firefox
- Thunderbird