Installation

The Installation section is where you generate, deploy, and manage Dev Machine Guard across your fleet. It has two pages:

• Script — a four-step wizard that generates a ready-to-deploy installation package for macOS, Windows, or Linux.
• Settings — organization-wide configuration: the telemetry key agents authenticate with, and the device-activity threshold.

For step-by-step fleet rollout guides for each MDM platform, see MDM Deployment.

How Dev Machine Guard is deployed

Dev Machine Guard is delivered using a two-piece architecture:

• The loader script is a lightweight shell (macOS, Linux) or PowerShell (Windows) script that you deploy through your existing MDM or EDR tooling. It downloads the Dev Machine Guard binary, writes the embedded configuration to disk, and delegates execution to the binary.
• The Dev Machine Guard binary (stepsecurity-dev-machine-guard) is published on GitHub Releases at github.com/step-security/dev-machine-guard. On each scheduled run, the loader:

  • Fetches a signed version manifest from the StepSecurity API.
  • Verifies the manifest signature against the StepSecurity releases public key, which is embedded in the loader at the time it is generated.
  • Downloads the binary identified by the manifest from GitHub Releases.
  • Verifies the binary's SHA-256 against the value in the signed manifest.
  • Executes the binary only if both verifications pass.

  The signature is an Ed25519 SSH signature, verified using ssh-keygen -Y verify. The signing key ([e-mail]) is held by StepSecurity and is the trust root for every released build. The corresponding public key, which you can use to independently verify the signed checksum, is:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILN+WG4lOH/x6MysYOf1oY0PKXLLu9d3ZvQDcvq5Cboi [e-mail]

This separation has two practical benefits:

1. You only need to deploy the loader script once via MDM. Binary updates are delivered automatically the next time the loader runs, without requiring an MDM redeploy.
2. Every binary the loader runs is cryptographically tied back to a single trust root: the StepSecurity releases signing key. Because that key is embedded in the loader rather than a per-build checksum, devices stay safe across version changes without re-deploying the loader. Substituting a malicious binary would require compromising both the StepSecurity API and the offline signing key, not just one or the other.

Signed installer (Windows)

For Windows fleets, Dev Machine Guard also ships as a signed Windows Installer (.msi), published on GitHub Releases for both x64 and ARM64 architectures. The MSI integrates natively with Windows application-management tooling (SCCM, Intune Win32 apps, GPO software installation), exposes a standard ProductCode and UpgradeCode for detection and supersedence, and never spawns PowerShell during install, upgrade, or uninstall.

The MSI is the recommended path for production Windows fleets, especially in environments where EDR blocks PowerShell from making outbound network calls. See Windows MDM Deployment for details.

What the agent does not collect

The Dev Machine Guard binary is designed to collect only the metadata required for supply chain visibility. It does not collect:

• Source code
• Secrets or credentials
• Personal data outside the developer's installed tooling inventory

For details on what data Dev Machine Guard does collect, see the Devices page.