Learn that a release exists#

You will end up with a job somewhere else that tells you when a newer Wheelhouse version is published, because the router will not.

Nothing on the router checks. There is no update notification, no "a newer version is available" banner, and the agent never asks anyone whether it is current. That is deliberate — see what the router sends — and it means the watching is yours to arrange.

Before you start#

A machine that is not the router and can reach the download host.
Somewhere to send a message: an existing monitoring system, a mailbox, a chat webhook.

Step 1 — Know what you are running#

On the console: the banner above every login prompt prints the Wheelhouse version and the VyOS version it is built on.

In the UI: System → Overview.

From a shell on the router:

bash

wheelhouse-agent --version          # wheelhouse-agent 0.5.1
wheelhouse-agent version            # the same thing as a subcommand
dpkg-query -W -f='${Version}\n' wheelhouse-agent   # what the package manager thinks

Both forms are answered before any configuration is read, any secret file is opened or any client is built, so a router whose agent will not start still answers "what version are you on". dpkg-query answers a different question — what the package manager installed — which differs from the running binary if somebody replaced it by hand.

From the API, signed in:

bash

R=https://<router>:8443
T=wh_...
curl -sk -H "Authorization: Bearer $T" "$R/api/version"      # the VyOS version

Step 2 — Poll the channel index#

From the release after 0.5.1 onwards, the download host carries a machine-readable channel index. stable.json is the newest release tag; beta.json is the same for pre-release tags.

bash

curl -s https://releases.rhymelikedi.me/stable.json |
  python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["version"], d["notes"])'

stable.json

{
  "channel": "stable",
  "version": "0.5.1",
  "tag": "v0.5.1",
  "released": "2026-09-01T12:00:00Z",
  "base": "https://releases.rhymelikedi.me/v0.5.1/",
  "notes": "https://releases.rhymelikedi.me/v0.5.1/CHANGELOG.md",
  "checksums": "SHA256SUMS",
  "signature": "SHA256SUMS.asc",
  "signed": false,
  "artifacts": [
    {"name": "wheelhouse-0.5.1-amd64.iso", "kind": "iso", "arch": "amd64",
     "size": 512483328, "sha256": "…"},
    {"name": "wheelhouse-agent_0.5.1_amd64.deb", "kind": "deb", "arch": "amd64",
     "size": 9911244, "sha256": "…"}
  ]
}

The fields are stable. version is the comparison key; base plus an artefact name forms the download URL; sha256 is what to check; signed says whether signature is real. Unknown fields may be added, so a consumer must ignore what it does not recognise.

Step 3 — Compare it with what you run#

A small script on the monitoring host. It reads the running version from the router's own banner facts over SSH, or from a file you keep, and complains when the channel moves ahead of it.

/usr/local/bin/wheelhouse-release-check

#!/bin/sh
set -eu
channel=https://releases.rhymelikedi.me/stable.json
have=$(ssh wheelhouse@edge "dpkg-query -W -f='\${Version}' wheelhouse-agent")
want=$(curl -fsS "$channel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["version"])')
[ "$have" = "$want" ] && exit 0
notes=$(curl -fsS "$channel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["notes"])')
echo "edge runs $have; $want is published. Notes: $notes"
exit 1

Run it from cron and let the non-zero exit be the alert, or pipe the message into whatever you already use. The check is a string comparison, not a version comparison — which is fine for "these differ, go and look" and is not enough to decide which is newer.

Step 4 — Read the release notes before you upgrade#

CHANGELOG.md is published beside the files on the download host and in the repository. Security fixes are called out in a Security section there. That is the whole notification mechanism today: there is no advisory feed and no published patch cadence.

What is not built#

Check it worked#

Run the script by hand against a version you know is old and confirm it complains, then against the current one and confirm it is silent. A monitoring check that has never fired is not the same as a monitoring check that works.

Undoing it#

Remove the cron entry.

Learn that a release exists#

Before you start#

Step 1 — Know what you are running#

Step 2 — Poll the channel index#

Step 3 — Compare it with what you run#

Step 4 — Read the release notes before you upgrade#

What is not built#

Check it worked#

Undoing it#

See also#