Download#

One image per release, with its checksum and the record of the source it was built from, on a release host that answers only to a licence key. Buying a plan is how the key reaches you; the closed beta gets one by invitation. There is no public download, and no plan is free.

See the plans Hardware

What your key opens

The release host

releases.rhymelikedi.me. Paste the key at /download in a browser and every release directory opens for twelve hours; from a shell the key is the password. It is the same key you enter on the router's Licence page.

The image

wheelhouse-<version>-amd64.iso, about 595 MB. A hybrid ISO: write it to a stick byte for byte, or attach it to a hypervisor as a virtual CD.

Its corresponding source

SOURCES-<version>-amd64.txt: the vyos-build commit the image was built from, and every package version in it. It ships beside the image and on the installed system.

Open the host with your key, and check what you fetch#

In a browser, go to releases.rhymelikedi.me/download, paste the key, and pick the release. From a shell the key is the password and the user name does not matter. Substitute the version you are actually fetching; the file names carry it.

bash

export WHL_KEY='WHL1.…'            # your licence key, from the purchase e-mail
curl -fL -u "licence:$WHL_KEY" -O https://releases.rhymelikedi.me/latest/wheelhouse-0.7.0-amd64.iso
curl -fL -u "licence:$WHL_KEY" -O https://releases.rhymelikedi.me/latest/wheelhouse-0.7.0-amd64.iso.sha256
sha256sum -c wheelhouse-0.7.0-amd64.iso.sha256
# wheelhouse-0.7.0-amd64.iso: OK

On macOS, shasum -a 256 -c. Where a release carries a directory-wide SHA256SUMS:

bash

curl -fL -u "licence:$WHL_KEY" -O https://releases.rhymelikedi.me/latest/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS

Without a key the host answers 401 with a WWW-Authenticate challenge; a browser is sent to the key form instead. A lapsed or revoked licence is refused with the reason. The channel index — stable.json and beta.json — needs no key: it carries versions and checksums and nothing else. Check the checksum before you write the stick: an image that arrived wrong fails in ways that look like broken hardware.

--ignore-missing is there because you will normally have downloaded one file out of several. Read the output: it must name the file you downloaded and say OK. With nothing downloaded, --ignore-missing also exits zero, which is the failure mode to watch for.

A checksum proves transport, not provenance

It detects a corrupt download. It does not detect a hostile one: the checksum is served from the same host as the image, so anyone who could replace one could replace the other.

A signature is the part that would prove who built it. That is the next paragraph, and it is not good news yet.

Write the medium and boot#

bash

lsblk -d -o NAME,SIZE,MODEL
sudo dd if=wheelhouse-0.5.1-amd64.iso of=/dev/sdX bs=4M status=progress conv=fsync

On macOS, diskutil list, then unmount (do not eject) and write to /dev/rdiskN. On Windows, Rufus in DD image mode rather than ISO mode.

What will and will not boot it#

amd64 only. That is the only image the build produces. There is no arm64 image, and no package or binary gives you a router on any architecture.
UEFI and legacy BIOS are both built in. The image carries grub-efi-amd64 and grub-pc.
Secure Boot is untested. Assume you have to turn it off. Nothing in the build signs the kernel with a key your firmware trusts, and nobody has reported booting a Wheelhouse image on a Secure Boot machine either way.
There is no VM image. No qcow2, raw, OVA or VHD. A VM install is the same install: attach the ISO, give the machine two NICs and a disk, and answer the questions.

What else is in a release directory#

File	What it is
`wheelhouse-<v>-amd64.iso`	the installable image — this is the product
`wheelhouse-<v>-amd64.iso.sha256`	its own checksum sidecar
`wheelhouse-agent_<v>_<arch>.deb`	the agent package, licensed-only like everything else here: a router you already run installs it in place to get a newer agent without a new image
`SHA256SUMS`	checksums for the directory
`SHA256SUMS.asc`	a detached signature over `SHA256SUMS`
`SOURCES-<v>-amd64.txt`	the corresponding-source record: the `vyos-build` commit the image was built from, and every package version in it
`vyos-build-wheelhouse-<v>-amd64.patch`	the changes Wheelhouse makes to VyOS' build tooling, published because that tooling is GPL
`CHANGELOG.md`	what changed in this release

The directory-wide SHA256SUMS, its .asc signature, CHANGELOG.md and the vyos-build patch arrive from the release after 0.5.1 onwards, along with a channel index naming the newest version. In 0.5.1 and earlier there is no CHANGELOG.md on the host and no signature, which is why the ISO's own .sha256 sidecar is what the commands above check.

The agent .deb returns from the next release. It is behind the same key as the image — there is no open package repository and no unauthenticated path to it — and it is there so a router you already run can take a newer agent in place instead of a whole new image. Its digest is a line of SHA256SUMS like everything else; nothing signs it, because no release is signed yet. The bare-binary tarballs are not published: they are build artefacts, and nothing installs one on a router.

A specific version lives at /v0.7.0/. A pre-release tag gets its own directory and an entry in beta.json, and leaves /latest/ on the current release.

Watching for a new version#

Each channel is a small JSON document at the root of the download host, rewritten whenever a tag publishes:

https://releases.rhymelikedi.me/stable.json
https://releases.rhymelikedi.me/beta.json

version is the comparison key, base plus an artefact name forms the download URL, sha256 is what to check, and signed says whether signature is real. Fields are stable and consumers must ignore unknown ones. A plain vX.Y.Z tag is stable; a pre-release suffix is beta. Neither channel is ever moved backwards. /latest/ follows the stable channel, so beta.json is the only place a release candidate is announced.

The router reads the stable index on a timer and the System page says when a newer version exists. It installs nothing itself, and the URL it suggests does not carry your key.

Before you install#

Read Hardware for sizing and what has actually been run, and Install and migrate for what the installer asks. If you are coming from OPNsense, the importer turns a config.xml into commands plus a report before you touch the new box.

Install it in a VM first

Attach the ISO, give the machine two NICs and a disk, and answer the questions. That is the path with the most evidence behind it.

See the plans Read the install guide

Read on#

The wiki: download and verify and what a checksum proves.