Software Bundle on macOS

This guide walks you through installing the TrustDID software bundle on a Mac. There are two downloads, each a single signed installer (.pkg) that you open like any other Mac installer:

Free — the verifier only. It checks sealed documents; there is no account and nothing to activate.
Suite — every TrustDID tool, for every plan. Your plan's license decides which tools run, so moving to another plan never means a new download.

The installer and the tools are signed by TrustDID Solutions Inc. and notarized by Apple, so macOS opens them without warnings.

Installing takes a couple of minutes. Activating a plan takes a few more, and longer if your identity lives on your own domain, because you publish DNS records.

Before you start

You need:

The installer for your Mac's chip, from the Downloads page. To check which chip you have, open the Apple menu → About This Mac: a Chip line starting with Apple M means Apple Silicon; a Processor line naming Intel means Intel.
- Apple Silicon: trustdid-free-darwin-arm64.pkg or trustdid-suite-darwin-arm64.pkg
- Intel: trustdid-free-darwin-amd64.pkg or trustdid-suite-darwin-amd64.pkg
For a plan: your enrolment email — it contains your activation token and ID. Free skips this.
An administrator account on the Mac — the installer asks for your password (or Touch ID) so it can install the tools for the whole Mac.
macOS 12 Monterey or later.

Step 1: Open the installer

In your Downloads folder, double-click the file you downloaded, for example trustdid-suite-darwin-arm64.pkg.
Check who signed it, if you want to be sure. Click the lock icon at the top right of the installer window. The certificate must read Developer ID Installer: TrustDID Solutions Inc., marked This certificate is valid. That signature is the part a forger cannot fake. If it says anything else, or macOS warns that it can't check the installer for malicious software, stop and email support@trustdid.ca.

Step 2: Click through the installer

The installer has no options to choose, and finishes in under a minute:

Introduction — lists what will be set up → Continue.
Installation Type → Install, then enter your password or use Touch ID.
On Suite, macOS may ask you to allow changes to certificate trust settings. Enter your password again: this trusts the local certificate described below, which exists only on this Mac.
Summary → Close. It reminds you of the next step and of how to uninstall.

What the installer does

For reference — every step is automated and you don't need to do these manually:

Step	What happens
Files	Copies the tools listed in the bundle's `manifest.json` to `/usr/local/bin/`.
PATH	Nothing to change: `/usr/local/bin` is on every Mac user's `PATH`, so every tool runs from Terminal.
Right-click	Adds Finder Quick Actions — Verify on Free; Verify / Sign / Encrypt / Decrypt on Suite — and switches them on.
Outlook	Suite: lays down the Outlook add-in under `/usr/local/share/trustdid/outlook-plugin/`.
Certificate	Suite: creates a local-only certificate for `https://localhost:8080` and trusts it in the System keychain, so Safari, Chrome, Mail and Outlook can talk to the service.
Service	Suite: registers the TrustDID service as a login item (a launchd agent) that starts by itself once your identity is set up.
Uninstaller	Keeps an uninstaller at `/usr/local/share/trustdid/uninstall.sh`.

Step 3: Activate your identity

On Free there is nothing to activate — right-click a file in Finder and choose Quick Actions → Verify with TrustDID, or run trustdid-verify FILE in Terminal, and skip to Next: install a plugin.

On Suite, the software is installed but doesn't have an identity yet. To activate, you run trustdid-setup with the token + ID from your enrolment email. There is no license key to type in — --managed mode generates your keys, publishes your DID, and pulls your license straight from the API in one step.

Open Terminal: press Cmd+Space, type Terminal, and press Return.
Run the command from your enrolment email and follow the prompts.
- Any plan — run trustdid-setup --managed YOUR_TOKEN YOUR_ID with the token and ID from your enrolment email. One command covers every plan; your account type is detected from the token. Step 1 of the Small Business guide walks through the prompts and the self-managed alternative.
- Member of a business — your admin's invite email carries the same one-line command with an invite instead of a business token. It creates your own keys on this Mac, publishes your identity under the business, and stores your personal token. Shared profiles your admin grants you arrive on their own once the service runs (or now, with trustdid-setup --sync).
- Enterprise — your account manager will have provided a dedicated onboarding guide.

The TrustDID service starts by itself as soon as setup finishes, and at every login after that. You're now signed in and the local service is ready for plugins.

Your plan and the Suite

The Suite installs every tool, and your license decides which ones run. A tool your plan doesn't include tells you so when you start it — for example "Encryption is not included in your Starter plan" — with a link to compare plans. After you change plans, refresh this Mac's license:

trustdid-setup --pull

No reinstall is needed. To move from Free to the Suite, open the Suite installer: it installs over Free.

Step 4: Check your installation

Run:

trustdid-check

It validates your keys, configuration, DID publication, DNS records, your license, and any configured trust registries in one pass, printing a line per check. Run it any time something feels off — it's the fastest way to find out which piece is missing.

To check the service itself, run:

trustdid-service status

It shows whether the service is running, and whether it answers at https://localhost:8080 with a trusted certificate.

Add a registry you trust

Verification answers two questions: is the document genuine, and who vouches for the signer? The second answer comes from the trust registries your verifier consults. To add one:

trustdid-setup --add-trusted-registry REGISTRY_DID

Use trustdid-setup --list-trusted-registries to see what's configured and trustdid-setup --remove-trusted-registry REGISTRY_DID to drop one. After adding, trustdid-check re-validates every configured registry — it resolves the registry's DID, probes its TRQP v2.0 endpoint, and reports whether the registry is public or private (private registries require a query token from the registry owner).

Not the same flag: trustdid-setup --add-trust-registry (no "ed") publishes your own claimed affiliation in your DID document. It carries no trust weight by itself and does not affect which registries your verifier consults — that's what --add-trusted-registry is for.

What landed where

After the Suite install + activate sequence (Free installs trustdid-verify and the Verify Quick Action only):

/usr/local/bin/
            ├── trustdid-setup            Identity setup and license activation
            ├── trustdid-service          Local API + static server (8080 / 8000)
            ├── trustdid-verify           Offline .vrfy verifier
            ├── trustdid-check            Installation and trust-registry checker
            ├── trustdid-keytool          Key generation and rotation
            ├── trustdid-sign             Seal a file
            ├── trustdid-sign-dir         Seal every file in a folder
            ├── trustdid-encrypt          Encrypt for one or more DIDs
            ├── trustdid-decrypt          Decrypt what was sent to you
            ├── trustdid-profile          Manage signing profiles
            └── trustdid-test-local       Self-test of this installation

            /usr/local/share/trustdid/
            ├── manifest.json             What this bundle ships
            ├── uninstall.sh              The uninstaller
            └── outlook-plugin/           Outlook add-in

            ~/.trustdid/
            ├── config.json               Your profiles and service settings
            ├── identities/               Each identity's license and token
            ├── keys/                     Your private keys (Ed25519 / X25519 / ML-DSA-44)
            └── localhost.crt, .key       The local-only certificate (Suite)

            ~/Library/LaunchAgents/ca.trustdid.service.plist   The service (Suite)
            ~/Library/Logs/TrustDID/service.log                Its log
            ~/Library/Services/…with TrustDID.workflow         The Quick Actions

The service is managed with trustdid-service start, stop and status — no sudo needed, since it runs as you.

To remove TrustDID later, run in Terminal:

sudo /usr/local/share/trustdid/uninstall.sh

It stops the service, removes the tools, the Quick Actions and the local certificate, and asks twice before touching your identity and keys under ~/.trustdid/. Answer No to keep them.

Troubleshooting

A tool says your license is missing, expired or doesn't include it. Run trustdid-setup --pull to fetch your current license, then trustdid-check. If the tool isn't in your plan, the message links to the plans; if the license expired, renew and pull again. Still stuck? Contact support@trustdid.ca with your enrolment receipt and we'll re-issue.

The Quick Actions don't appear when you right-click a file. Right-click a file (not the desktop background) and open Quick Actions ▸ Customize…, then tick the … with TrustDID actions. If they aren't listed, run killall Finder in Terminal and look again.

macOS asks whether Terminal may access your Documents or Downloads folder. That's the Quick Action opening your file in Terminal. Choose Allow.

trustdid-verify: command not found. Open a new Terminal window. If it still isn't found, check that /usr/local/bin is listed by echo $PATH; if it isn't, your shell setup replaces the default PATH — add export PATH="/usr/local/bin:$PATH" to ~/.zshrc.

The service isn't running. Run trustdid-service status. It shows the state and, if the service stopped, its last exit code; the details are in ~/Library/Logs/TrustDID/service.log. The service only runs once your identity is set up, so run trustdid-setup first. If the log says a port is already in use, another program took it: set service.apiPort in ~/.trustdid/config.json to a free port such as 18080, then run trustdid-service start.

Firefox or Thunderbird doesn't trust https://localhost:8080. They keep their own certificate list. Either install Homebrew's nss package (brew install nss) and open the installer again, which then adds the certificate to them too, or set security.enterprise_roots.enabled to true in their Config Editor so they use the Mac's trusted certificates.

You installed the Intel version on an Apple Silicon Mac. It runs under Rosetta, Apple's translation layer, but more slowly. Uninstall it and install the Apple Silicon version.

Going from the Suite back to Free. Uninstall first, then install Free: installing Free over the Suite keeps the Suite tools that Free doesn't include.

Next: install a plugin

The bundle gives you the command-line tools and the service. To sign and verify inside your daily tools, install the matching plugin:

Outlook — the add-in is already bundled at /usr/local/share/trustdid/outlook-plugin/manifest.xml, and adding it works as in Outlook on Windows. In the file dialog, press Cmd+Shift+G and paste that path: /usr/local is hidden in Finder.
Chrome / Edge
Firefox
Thunderbird

Each plugin's online guide has its own walkthrough.