A point to add not touched upon yet -- while there is US federal law regarding manufacturing, trafficking,and distributing steroids, it includes only specific substances and formulations. New ones get added continuously, but until a specific formula is defined as a controlled steroid, it is not an illicit material.
So any lawbreaking that McGwire might have been engaging in, would depend upon what he was using.
As an example, for part of the apparent time when Bonds was using "clear" (THG), it had not yet been added to the federal list. It was banned in late 2003.
Sticky point that makes people unhappy, but true nonetheless, from a legal standpoint (United States federal law) anyway. Lynch mobs tend not to be so technical or picky.
Available general version, of Schedule III, which is referenced by the current MLB Joint Drug Agreement as explicitly included above and beyond anything defined in the JDA: http://www.deadiversion.usdoj.gov/schedules/listby_sched/sched3.htm
MLB did have a policy, issued by Commissioner Vincent in 1991, which was not collectively bargained, had no defined procedures for testing, enforcement, or punitive response, and was largely forgotten by everyone in the game until it resurfaced a few years ago. Even Commissioner Selig considers it non-binding, possibly because it is non-functional, it doesn't DO anything. It amounted to little more than a sternly worded warning advisory.