Enterprise deployment & trust guide
How to roll the Cleanwork agent out across your managed Windows, macOS and Linux devices. Our installers are not code-signed yet; trusted signing is coming as PTM grows and will remove the prompts below. On a managed fleet your tooling can deploy and trust the agent centrally, so employees never see an "unknown publisher" warning.
Verify the installer before you deploy
Because the installers are unsigned, verify authenticity by checksum rather than by signature. Every release publishes a SHA-256 for each file, shown on the downloads page. Download once, confirm the hash, then distribute that verified file from your own repository.
REM Windows (PowerShell)
Get-FileHash ".\PTM Clearwork-Setup-1.7.0-x64.exe" -Algorithm SHA256
# macOS
shasum -a 256 "PTM Clearwork-1.7.0-mac-"*.dmg
# Linux
sha256sum "PTM Clearwork-1.7.0-linux-"*.AppImageIntune, SCCM or GPO
Deploy in a management (SYSTEM) context. Software pushed by Intune, SCCM or a GPO startup script installs without the interactive SmartScreen prompt an employee would see when double-clicking an unsigned installer.
REM Per-machine silent install into the default location
"PTM Clearwork-Setup-1.7.0-x64.exe" /S
REM Silent install into a chosen directory ( /D must be last and unquoted )
"PTM Clearwork-Setup-1.7.0-x64.exe" /S /D=C:\Program Files\PTM ClearworkIntune: wrap the installer as a Win32 app (.intunewin), set the install command to the /S line above, add a detection rule on the install path or version, and assign it to your device groups.
Antivirus and SmartScreen: an unsigned monitoring agent is more likely to be flagged. Add an exclusion for the install path (for example %ProgramFiles%\PTM Clearwork) and the agent process, and allow the app in any application-control policy you enforce.
Note: adding a publisher to the Windows Trusted Publishers store only works for signed software, so it does not apply while the agent is unsigned. The working path today is management-context deployment plus the exclusions above. Once signed builds ship you will add the Cleanwork publisher certificate to Trusted Publishers and the prompts disappear.
Jamf, Intune, Kandji or another MDM
Gatekeeper blocks unsigned, un-notarized apps for a normal user. On a managed Mac, deploy through your MDM; MDM-delivered apps are not subject to the interactive Gatekeeper prompt.
Packaging: current downloads are .dmg and .zip, which hold the .app. Most MDMs deploy a .pkg, so wrap the .app in a signed .pkg with your own packaging, or request a .pkg build from PTM.
Permissions: push a PPPC (Privacy Preferences Policy Control) profile granting the agent Screen Recording (for screenshots) and Apple Events / Automation (to read the frontmost app and browser address bar). Apple does not allow Screen Recording to be silently pre-granted on all macOS versions; on those, each user approves Screen Recording once on first run, so plan a short note to employees.
When notarized builds arrive, the Gatekeeper prompt disappears and you can remove any temporary allow policy.
Ansible, a package repository or an image
Linux packages are unsigned and need no publisher approval.
Distribute the .deb or .rpm through your configuration management or an internal repository. These packages declare the runtime tools the agent needs (ImageMagick, xrandr, xdotool, python3), so capture and activity tracking work on a fresh install. The AppImage bundles the app but cannot declare those tools, so prefer .deb or .rpm for managed fleets. The agent requires an X11 session; Wayland is not supported, so set the login session to X11 (Xorg) where screenshots are required.
The trust path per system
| System | Today (unsigned) | After signing |
|---|---|---|
| Windows | Deploy via Intune/SCCM/GPO in SYSTEM context; add antivirus and SmartScreen exclusions | Add publisher to Trusted Publishers; prompts gone |
| macOS | Deploy via MDM; push PPPC for Screen Recording and Apple Events | Notarized build opens with no prompt |
| Linux | Install .deb/.rpm; no approval needed | Unchanged |
Monitoring software must be deployed transparently. Tell employees what is recorded and why, in line with your policy and local law, before you enable monitoring. Questions? Contact PTM.