Download EasyDeploy Platform

Standard distribution package for all tiers — Free and MSP Advanced share the same binaries. Platform v5 is the current release; Platform v4 remains available as legacy for existing deployments. Refer to What's new for more information.

SHA256 v4: 85ca6857a7ba32ac0052bcad393da465c8a17aeca486734b76c2687db9fa0aa4

SHA256 v5: e3e7ac560e4be7a8d7acf46cc6bbaf1a3e64f1c0a88d80c03092f9af52076d11

After downloading, please verify the SHA256 (guide in the Security notes section) before use.

Package Structure

Both packages (EasyDeploy-Platform.zip for v4, EasyDeploy-Platform-v5.zip for v5) are distributed via R2, shared by all tiers and use the same layout:

[1] EasyDeploy-Platform.zip
├── EasyDeploy.BootBuilder.exe
├── EasyDeploy.BootBuilder.exe.sig   ← YubiKey signature
├── Links.md
└── EasyDeploy\
    ├── EasyDeploy.exe
    ├── EasyDeploy.exe.sig           ← YubiKey signature
    └── system-config.json

[2] SHA256 hash of the .zip file (published with each release)

Extract to use. The package does not include the Portable apps — the tools in the default configuration (MultiDrive, HWiNFO64, Explorer++, Pale Moon) are reference design choices only. Bring your own: add them via BootBuilder at build time, or copy them manually into Softwares\ and declare them in user-config.json. See Configuration for details.

Security Notes

YubiKey Signature (.sig) & Trust Chain

Each .exe ships with a detached .sig (ECDSA P-256) signed by CoreSystem's YubiKey; the public key is embedded in the tools.

BootBuilder verifies its own signature on startup — a missing .sig, a renamed copy or a modified binary is refused (fail-closed). It also verifies EasyDeploy.exe.sig before building media, so a tampered EasyDeploy binary is blocked at build time. The EasyDeploy deploy client does not self-verify; its integrity is enforced by BootBuilder when the media is created.

SHA256 Hash

Every release publishes the SHA256 hash of the .zip file. Please verify before use:

Get-FileHash .\EasyDeploy-Platform.zip -Algorithm SHA256
# compare with the hash published on the website

Only download from the official CoreSystem link. Add the file to your Antivirus exclusion if it is falsely flagged (binary is not yet Authenticode-signed).

Recommendation: always verify both SHA256 and .sig before running, especially when receiving the file via an intermediary.

What's Next