Software Bundle on Linux

This guide installs the TrustDID software bundle on Linux. The binaries are statically-linked Go and have no runtime dependencies — extract, drop into /usr/local/bin, run.

What's in the bundle

trustdid/
            ├── bin/
            │   ├── trustdid              CLI for signing and identity management
            │   ├── trustdid-setup        Identity setup and license activation
            │   ├── trustdid-check        Environment and trust-registry checker
            │   ├── trustdid-service      Local API + static server (ports 8080, 8000)
            │   └── trustdid-verify       Offline .vrfy verifier
            ├── service/
            │   ├── trustdid.service      systemd unit
            │   └── install-service.sh
            ├── config/
            │   └── config.example.json
            ├── INSTALL.txt               The plaintext version of this guide
            ├── LICENSE
            └── CHANGELOG.md

Step 1: Extract and install

tar -xzf trustdid-prof-annual-linux-amd64.tar.gz
            sudo install -m 0755 trustdid/bin/* /usr/local/bin/

(If you prefer to keep everything together: sudo mv trustdid /opt/trustdid and add /opt/trustdid/bin to your PATH.)

Verify:

trustdid version

Step 2: Activate your identity

For paid tiers, your enrolment email contains a token + UUID. There's no license key to type in — trustdid-setup --managed generates your keys, publishes your DID, and pulls your license from the API in one shot:

trustdid-setup --managed YOUR_TOKEN YOUR_ID

The same command covers every paid tier — Professional, Starter, Business and Enterprise. Whether your enrolment is a professional or a business account is detected from your token, so there is nothing to choose.

Free tier has no token. Just run trustdid-setup interactively and answer the prompts; you'll get a public test identity.

Joining a business as a member? Your admin sends an invite email with the same one-line command. It generates your own keys on this machine, publishes your identity under the business, and stores your personal token. Shared profiles your admin grants you (a #finance signing identity, say) arrive on their own: the service polls the business every 15 minutes, or run trustdid-setup --sync to fetch them now. The invite works once and expires after 7 days.

The setup writes:

~/.trustdid/config.json — DID, service binding
~/.trustdid/license.json — pulled from the API (paid tiers)
~/.trustdid/keys/ — your private keys (Ed25519 / X25519 / ML-DSA-44)

Then check it landed:

trustdid status

Look for "license: ok" (or "license: free") and your DID. To refresh later (after a renewal or scope change) re-run trustdid-setup --managed YOUR_TOKEN YOUR_ID.

Step 3: Check your setup

Run:

trustdid-check

It validates your keys, configuration, DID publication, DNS records, and any configured trust registries in one pass, printing a line per check.

Add a registry you trust

Verification answers two questions: is the document genuine, and who vouches for the signer? The second answer comes from the trust registries your verifier consults. To add one:

trustdid-setup --add-trusted-registry REGISTRY_DID

Use trustdid-setup --list-trusted-registries to review and trustdid-setup --remove-trusted-registry REGISTRY_DID to drop one. After adding, trustdid-check re-validates every configured registry — it resolves the registry's DID, probes its TRQP v2.0 endpoint, and reports whether the registry is public or private.

Not the same flag: trustdid-setup --add-trust-registry (no "ed") publishes your own claimed affiliation in your DID document; it doesn't affect which registries your verifier consults.

Step 4: Run the service

The service backs every browser and email plugin.

trustdid-service run

Test from another terminal:

curl --insecure https://localhost:8080/health

You should see {"status":"ok"}. The cert is self-signed and only ever lives on your machine — --insecure is fine here.

Step 5 (optional): Install as a systemd service

To start with the machine and survive crashes:

sudo cp service/trustdid.service /etc/systemd/system/
            sudo systemctl daemon-reload
            sudo systemctl enable --now trustdid.service

Check status:

systemctl status trustdid.service
            journalctl -u trustdid.service -f

Troubleshooting

trustdid: command not found. Either /usr/local/bin isn't on your PATH (unusual), or install failed silently. Re-run with sudo install -v ... and watch for errors.

bind: address already in use on port 8080. Another service grabbed it. Edit ~/.trustdid/config.json, change service.bind to a free port (e.g. 127.0.0.1:18080), and update the plugin options to match.

systemd unit fails with (code=exited, status=203/EXEC). The unit's ExecStart path doesn't match where you installed the binary. Edit /etc/systemd/system/trustdid.service, fix the path, then systemctl daemon-reload && systemctl restart trustdid.

Next: install a plugin

Outlook on Windows (if you reach Outlook from Linux via Wine or RDP, the manifest install still works the same way)
Chrome / Edge
Firefox
Thunderbird