WIP

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.circleci/config.yml

@@ -51,76 +51,6 @@ commands:
           paths:
             - ~/.cache/uv
 
-  install-zfs-from-source:
-    parameters:
-      zfs_release:
-        type: string
-    steps:
-      - run:
-          name: Record kernel version for cache key
-          command: uname -r > /tmp/kernel-version
-      - restore_cache:
-          name: Restore ZFS native debs cache
-          keys:
-            - zfs-debs-v2-<<parameters.zfs_release>>-{{ checksum "/tmp/kernel-version" }}
-      - run:
-          # https://openzfs.github.io/openzfs-docs/Developer%20Resources/Building%20ZFS.html
-          name: Build ZFS <<parameters.zfs_release>> native debs (if not cached)
-          no_output_timeout: 20m
-          command: |
-            # CircleCI machine images have pyenv Python 3.13 shadowing the system
-            # Python 3.12. The apt python3-* packages (setuptools, cffi, etc.) only
-            # install for the system Python, and ZFS's dpkg-buildpackage needs them
-            # for --enable-pyzfs. Use the system Python so apt packages are visible.
-            export PYENV_VERSION=system
-            if [ -d /tmp/zfs-debs ]; then
-              echo "ZFS debs cache hit, skipping build"
-              exit 0
-            fi
-            sudo apt-get update
-            sudo apt-get install -y \
-              alien autoconf automake build-essential debhelper-compat dh-autoreconf \
-              dh-dkms dh-python dkms fakeroot gawk git libaio-dev libattr1-dev \
-              libblkid-dev libcurl4-openssl-dev libelf-dev libffi-dev libpam0g-dev \
-              libssl-dev libtirpc-dev libtool libudev-dev linux-headers-$(uname -r) lsb-release \
-              parallel po-debconf python3 python3-all-dev python3-cffi python3-dev \
-              python3-packaging python3-setuptools python3-sphinx uuid-dev zlib1g-dev
-            mkdir -p /tmp/zfs-build
-            cd /tmp/zfs-build
-            git clone --depth 1 --branch <<parameters.zfs_release>> https://github.com/openzfs/zfs.git zfs-src
-            cd zfs-src
-            sh autogen.sh
-            ./configure
-            make native-deb
-            mkdir -p /tmp/zfs-debs
-            find /tmp/zfs-build -name '*.deb' -exec mv -t /tmp/zfs-debs/ {} +
-      - save_cache:
-          name: Save ZFS native debs cache
-          key: zfs-debs-v2-<<parameters.zfs_release>>-{{ checksum "/tmp/kernel-version" }}
-          paths:
-            - /tmp/zfs-debs
-      - run:
-          name: Install ZFS <<parameters.zfs_release>>
-          command: |
-            ls /tmp/zfs-debs/
-            # Only install the debs we need. Exclude dracut (conflicts with
-            # initramfs-tools), dkms (we have prebuilt modules), and packages
-            # we don't need (pyzfs, test, doc).
-            sudo apt-get install -y $(find /tmp/zfs-debs -name '*.deb' \
-              ! -name '*dracut*' \
-              ! -name '*dkms*' \
-              ! -name '*initramfs*' \
-              ! -name '*pyzfs*' \
-              ! -name '*doc*' \
-              ! -name '*test*' \
-              -print)
-            sudo modprobe zfs
-      - run:
-          name: Verify ZFS version
-          command: |
-            sudo zfs version
-            sudo zpool version
-
   docs-publish-sh:
     parameters:
       push:
@@ -205,7 +135,7 @@ workflows:
               goversion: [*latest-go-release]
               goos: ["linux"]
               goarch: ["amd64"]
-              zfs_release: ["zfs-2.2.9", "zfs-2.3.5", "zfs-2.4.0"]
+              image: ["ubuntu-2204:current", "ubuntu-2404:current"]
           requires:
             - test-go
             - quickcheck-go-<< matrix.goarch >>-<< matrix.goos >>-<< matrix.goversion >>
@@ -309,11 +239,10 @@ jobs:
         type: string
       goarch:
         type: string
-      zfs_release:
+      image:
         type: string
     machine:
-      # pinned (not :current) to keep ZFS build cache valid across runs
+      image: <<parameters.image>>
-      image: ubuntu-2404:2025.09.1
     resource_class: medium
     environment:
       GOOS: <<parameters.goos>>
@@ -321,8 +250,9 @@ jobs:
     steps:
       - attach_workspace:
           at: .
-      - install-zfs-from-source:
+      - run: sudo apt-get update
-          zfs_release: <<parameters.zfs_release>>
+      - run: sudo apt-get install -y zfsutils-linux
+      - run: sudo zfs version
       - run: sudo make test-platform GOOS="$GOOS" GOARCH="$GOARCH"
 
   test-go:

Makefile

@@ -4,8 +4,17 @@
 
 ARTIFACTDIR := artifacts
 
-_ZREPL_VERSION := v0.7.0
+ifdef ZREPL_VERSION
-ZREPL_PACKAGE_RELEASE := 2
+    _ZREPL_VERSION := $(ZREPL_VERSION)
+endif
+ifndef _ZREPL_VERSION
+    _ZREPL_VERSION := $(shell git describe --always --dirty 2>/dev/null || echo "ZREPL_BUILD_INVALID_VERSION" )
+    ifeq ($(_ZREPL_VERSION),ZREPL_BUILD_INVALID_VERSION) # can't use .SHELLSTATUS because Debian Stretch is still on gmake 4.1
+        $(error cannot infer variable ZREPL_VERSION using git and variable is not overriden by make invocation)
+    endif
+endif
+
+ZREPL_PACKAGE_RELEASE := 1
 
 GO := go
 GOOS ?= $(shell bash -c 'source <($(GO) env) && echo "$$GOOS"')
@@ -264,7 +273,7 @@ cover-platform-bin:
 	$(GO_ENV_VARS) $(GO) test $(GO_BUILDFLAGS) \
 		-c -o "$(COVER_PLATFORM_BIN_PATH)" \
 		-covermode=atomic -cover -coverpkg github.com/zrepl/zrepl/... \
-		./platformtest/harness
+		./internal/platformtest/harness
 cover-platform:
 	# do not track dependency on cover-platform-bin to allow build of binary outside of test VM
 	export _TEST_PLATFORM_CMD="$(COVER_PLATFORM_BIN_PATH) \
@@ -280,25 +289,13 @@ test-platform:
 	export _TEST_PLATFORM_CMD="\"$(TEST_PLATFORM_BIN_PATH)\""; \
 		$(MAKE) _test-or-cover-platform-impl
 
-ZREPL_PLATFORMTEST_POOLNAME := zreplplatformtest
-ZREPL_PLATFORMTEST_IMAGEPATH := /tmp/zreplplatformtest.pool.img
-ZREPL_PLATFORMTEST_MOUNTPOINT := /tmp/zreplplatformtest.pool
-ZREPL_PLATFORMTEST_ZFS_LOG := /tmp/zreplplatformtest.zfs.log
-# ZREPL_PLATFORMTEST_STOP_AND_KEEP := -failure.stop-and-keep-pool
 ZREPL_PLATFORMTEST_ARGS :=
 _test-or-cover-platform-impl: $(ARTIFACTDIR)
 ifndef _TEST_PLATFORM_CMD
 	$(error _TEST_PLATFORM_CMD is undefined, caller 'cover-platform' or 'test-platform' should have defined it)
 endif
-	rm -f "$(ZREPL_PLATFORMTEST_ZFS_LOG)"
 	rm -f "$(ARTIFACTDIR)/platformtest.cover"
-	internal/platformtest/logmockzfs/logzfsenv "$(ZREPL_PLATFORMTEST_ZFS_LOG)" `which zfs` \
+	$(_TEST_PLATFORM_CMD) $(ZREPL_PLATFORMTEST_ARGS)
-		$(_TEST_PLATFORM_CMD) \
-		-poolname "$(ZREPL_PLATFORMTEST_POOLNAME)" \
-		-imagepath "$(ZREPL_PLATFORMTEST_IMAGEPATH)" \
-		-mountpoint "$(ZREPL_PLATFORMTEST_MOUNTPOINT)" \
-		$(ZREPL_PLATFORMTEST_STOP_AND_KEEP) \
-		$(ZREPL_PLATFORMTEST_ARGS)
 
 cover-merge: $(ARTIFACTDIR)
 	$(GOCOVMERGE) $(ARTIFACTDIR)/platformtest.cover $(ARTIFACTDIR)/gotest.cover > $(ARTIFACTDIR)/merged.cover
@@ -306,7 +303,6 @@ cover-html: cover-merge
 	$(GO) tool cover -html "$(ARTIFACTDIR)/merged.cover" -o "$(ARTIFACTDIR)/merged.cover.html"
 
 cover-full:
-	test "$$(id -u)" = "0" || echo "MUST RUN AS ROOT" 1>&2
 	$(MAKE) test-go COVER=1
 	$(MAKE) cover-platform-bin
 	$(MAKE) cover-platform

README.md

@@ -171,8 +171,6 @@ Run `make lint` and `make vet`.
 Update the CI configuration `.circleci/config.yml`:
 - Update Go version references (we reference the minimum and max supported version)
 - Set `Makefile` `RELEASE_GOVERSION` to the new Go version
-- Update the pinned ZFS release tags in the `platformtest` matrix (`zfs_release` parameter) to the latest patch releases of each OpenZFS branch (currently 2.2, 2.3, 2.4)
-- Update the pinned Ubuntu machine image for `platformtest` (e.g. `ubuntu-2404:2025.09.1`) — this is pinned rather than `current` so the ZFS build cache stays valid across runs
 
 Update docs build tooling:
 - Update `uv` version in `.circleci/config.yml` (search for `astral.sh/uv/` and cache keys containing the version)

docs/changelog.rst

@@ -13,36 +13,43 @@
 Changelog
 =========
 
-0.7.0
+The changelog summarizes bugfixes that are deemed relevant for users and package maintainers.
------
+Developers should consult the git commit log or GitHub issue tracker.
 
-* |feature| Config file inclusion using ``include`` directive.
+Next Release
-  This allows distributing zrepl job definitions across multiple YAML files in a ``conf.d`` style directory.
+------------
-  (:commit:`4d6583e`, thanks, `@ZeyadTamimi <https://github.com/zeyadtamimi>`_).
-* |feature| Add configurable timezone for snapshot name timestamps. The default remains UTC. (:commit:`b9b9ad1`, thanks, `@mjasnik <https://github.com/mjasnik>`_).
-* |feature| Improve Grafana dashboard with additional panels and refinements (:commit:`3f75127`, thanks, `@deajan <https://github.com/deajan>`_).
-* |bugfix| Fix replication of placeholder filesystems (:commit:`5615f49`).
-* |bugfix| Avoid using the word "error" in info-level log lines about ZFS command execution (:commit:`d3b2295`, thanks, `@bakhtiyarneyman <https://github.com/bakhtiyarneyman>`_).
-* |bugfix| Detect duplicate and internal job names at config parse time.
-  zrepl will now refuse to load a config with duplicate or internally reserved job names, instead of failing later at daemon startup.
-  (:commit:`860a9be`).
-* |docs| Add installation instructions for openSUSE (:commit:`40c4827`, thanks, `@findesgh <https://github.com/findesgh>`_).
-* |docs| Improve documentation on ``send_properties`` configuration and NFS/SMB considerations (:commit:`b5d8538`, thanks, `@Malvineous <https://github.com/Malvineous>`_).
-* |docs| Warn more prominently about the risks of the ``not_replicated`` keep rule (:commit:`affe00a`, thanks, `@wxiaoguang <https://github.com/wxiaoguang>`_).
-* |docs| Improve TLS/EasyRSA setup instructions (:commit:`e524b60`, thanks, `@alorimer <https://github.com/alorimer>`_).
-* |docs| ``zrepl.github.io``: auto-publish from ``master`` branch, retire ``stable`` branch (:commit:`4f950bb`).
-* |maint| ``zrepl status``: switch from the unmaintained ``cview`` fork back to the actively maintained ``tview`` library (:commit:`d7ede3f`).
-* |maint| Update to Go 1.25 toolchain with Go 1.24 language level & Go dependencies
-* |maint| Debian packages: proper bash completion placement (:commit:`2923009`)
-* |maint| RPM packages: AlmaLinux 8 for RPM builds (:commit:`27f4ad1`).
-* |maint| Improve build system & CI setup
 
-.. NOTE::
+The plan for the next release is to revisit how zrepl does snapshot management.
-  |  zrepl is a spare-time project primarily developed by `Christian Schwarz <https://cschwarz.com>`_.
+High-level goals:
-  |  You can support maintenance and feature development through one of the following services:
+
-  |  |Donate via Patreon| |Donate via GitHub Sponsors| |Donate via Liberapay| |Donate via PayPal|
+- Make it easy to decouple snapshot management (snapshotting, pruning) from replication.
-  |  Note that PayPal processing fees are relatively high for small donations.
+- Ability to include/exclude snapshots from replication.
-  |  For SEPA wire transfer and **commercial support**, please `contact Christian directly <https://cschwarz.com>`_.
+  This is useful for aforementioned decoupling, e.g., separate snapshot prefixes for local & remote replication.
+  Also, it makes explicit that by default, zrepl replicates all snapshots, and that
+  replication has no concept of "zrepl-created snapshots", which is a common misconception.
+- Use of ``zfs snapshot`` comma syntax or channel programs to take snapshots of multiple
+  datasets atomically.
+- Provide an alternative to the ``grid`` pruning policy.
+  Most likely something based on hourly/daily/weekly/monthly "trains" plus a count.
+- Ability to prune at the granularity of the **group** of snapshots created at a given
+  time, as opposed to the individual snapshots within a dataset.
+  Maybe this will be addressed by the alternative to the ``grid`` pruning policy,
+  as it will likely be more predictable.
+
+Those changes will likely come with some breakage in the config.
+However, I want to avoid breaking **use cases** that are satisfied by the current design.
+There will be beta/RC releases to give users a chance to evaluate.
+
+0.7.0 (unreleased)
+------------------
+
+INCOMPLETE LIST OF CHANGES
+
+* |maint| Update to Go 1.25 toolchain with Go 1.24 language level.
+* |maint| Fix deprecations exposed by the toolchain update.
+* |maint| Long-overdue update of all our dependencies & address deprecations.
+* |maint| Publish docs from ``master`` branch, retire ``stable`` branch.
+* |maint| The `make release-docker` in CircleCI produces executables that are bit-identical to my personal machine.
 
 0.6.1
 -----
@@ -58,6 +65,13 @@ Changelog
 * |maint| run platform tests as part of CI.
 * |maint| build: upgrade to Go 1.21 and update golangci-lint; minimum Go version for builds is now 1.20
 
+.. NOTE::
+  |  zrepl is a spare-time project primarily developed by `Christian Schwarz <https://cschwarz.com>`_.
+  |  You can support maintenance and feature development through one of the following services:
+  |  |Donate via Patreon| |Donate via GitHub Sponsors| |Donate via Liberapay| |Donate via PayPal|
+  |  Note that PayPal processing fees are relatively high for small donations.
+  |  For SEPA wire transfer and **commercial support**, please `contact Christian directly <https://cschwarz.com>`_.
+
 0.6
 ---
 
@@ -244,7 +258,7 @@ Additional changelog:
 * |bugfix| systemd + ``ssh+stdinserver``: automatically create ``/var/run/zrepl/stdinserver``
 * |bugfix| crash if Prometheus listening socket cannot be opened
 
-* [MAINTAINER NOTICE] ``Makefile`` refactoring, see commit :commit:`080f2c0`
+* [MAINTAINER NOTICE] ``Makefile`` refactoring, see :commit:`080f2c0`
 
 0.2
 ---
@@ -274,7 +288,7 @@ Additional changelog:
 0.1.1
 -----
 
-* |bugfix| :issue:`162` commit :commit:`d6304f4` : fix I/O timeout errors on variable receive rate
+* |bugfix| :issue:`162` :commit:`d6304f4` : fix I/O timeout errors on variable receive rate
 
   * A significant reduction or sudden stall of the receive rate (e.g. recv pool has other I/O to do)
     would cause a ``writev I/O timeout`` error after approximately ten seconds.

docs/conf.py

@@ -182,6 +182,6 @@ extlinks = {
     'issue':('https://github.com/zrepl/zrepl/issues/%s', 'issue #%s'),
     'repomasterlink':('https://github.com/zrepl/zrepl/blob/master/%s', '%s'),
     'sampleconf':('https://github.com/zrepl/zrepl/blob/master/internal/config/samples%s', 'internal/config/samples%s'),
-    'commit':('https://github.com/zrepl/zrepl/commit/%s', '%s'),
+    'commit':('https://github.com/zrepl/zrepl/commit/%s', 'commit %s'),
         }
 

docs/future.rst

@@ -1,33 +0,0 @@
-.. include:: global.rst.inc
-
-.. _future:
-
-Future
-======
-
-This page contains some notes about future plans for zrepl.
-Then again, Christian only has very limited time available for zrepl maintenance these days.
-So, don't count on any of this happening in the near future.
-
-One big development that has happened in recent years is this fork of zrepl: https://github.com/dsh2dsh/zrepl
-We should figure out whether we can pull in features from there.
-
-The next major step in terms of new feature development for zrepl would be to revise snapshot management:
-
-- Make it easy to decouple snapshot management (snapshotting, pruning) from replication.
-- Ability to include/exclude snapshots from replication.
-  This is useful for aforementioned decoupling, e.g., separate snapshot prefixes for local & remote replication.
-  Also, it makes explicit that by default, zrepl replicates all snapshots, and that
-  replication has no concept of "zrepl-created snapshots", which is a common misconception.
-- Use of ``zfs snapshot`` comma syntax or channel programs to take snapshots of multiple
-  datasets atomically.
-- Provide an alternative to the ``grid`` pruning policy.
-  Most likely something based on hourly/daily/weekly/monthly "trains" plus a count.
-- Ability to prune at the granularity of the **group** of snapshots created at a given
-  time, as opposed to the individual snapshots within a dataset.
-  Maybe this will be addressed by the alternative to the ``grid`` pruning policy,
-  as it will likely be more predictable.
-
-Those changes will likely come with some breakage in the config.
-However, I want to avoid breaking **use cases** that are satisfied by the current design.
-There will be beta/RC releases to give users a chance to evaluate.

docs/index.rst

@@ -136,7 +136,6 @@ Table of Contents
    usage
    pr
    changelog
-   future
    GitHub Repository & Issue Tracker <https://github.com/zrepl/zrepl>
    Chat: Matrix <https://matrix.to/#/#zrepl:matrix.org>
    supporters

docs/usage.rst

@@ -101,24 +101,20 @@ Along with the main ``zrepl`` binary, we release the ``platformtest`` binaries.
 The zrepl platform tests are an integration test suite that is complementary to the pure Go unit tests.
 Any test that needs to interact with ZFS is a platform test.
 
-The platform need to run as root.
+The platform tests require ``sudo`` ``NOPASSWD``-access to ``zfs`` and ``zpool``.
 For each test, we create a fresh dummy zpool backed by a file-based vdev.
-The file path, and a root mountpoint for the dummy zpool, must be specified on the command line:
+The pool name, image path, and mountpoint are hardcoded in the binary.
-
-::
-
-   mkdir -p /tmp/zreplplatformtest
-   ./platformtest \
-       -poolname 'zreplplatformtest' \  # <- name must contain zreplplatformtest
-       -imagepath /tmp/zreplplatformtest.img \ # <- zrepl will create the file
-       -mountpoint /tmp/zreplplatformtest # <- must exist
 
+The ``platformtest`` binary is a multi-personality binary (similar to busybox).
+It acts as a safety interposer for ``zfs`` and ``zpool`` commands, ensuring all operations
+reference the hard-coded test pool name ``zreplplatformtest``. It creates symlinks to itself in a temporary
+directory and replaces ``PATH`` so that all ``zfs``/``zpool`` invocations go through the interposer.
 
 .. WARNING::
 
-   ``platformtest`` will unconditionally overwrite the file at `imagepath`
+   ``platformtest`` will unconditionally ``zpool destroy`` the test zpool
-   and unconditionally ``zpool destroy $poolname``.
+   and unconditionally delete the image file that backs it.
-   So, don't use a production poolname, and consider running the test in a VM.
+   Consider running the test in a VM.
    It'll be a lot faster as well because the underlying operations, ``zfs list`` in particular, will be faster.
 
 

internal/platformtest/harness/harness.go

@@ -26,18 +26,23 @@ var bold = color.New(color.Bold)
 var boldRed = color.New(color.Bold, color.FgHiRed)
 var boldGreen = color.New(color.Bold, color.FgHiGreen)
 
-const DefaultPoolImageSize = 200 * (1 << 20)
-
 func main() {
+	// Multi-personality binary: check argv[0] to determine mode.
+	// When invoked via a symlink named "zfs" or "zpool", act as
+	// a safety interposer that validates commands and delegates
+	// to the real binary via sudo.
+	switch filepath.Base(os.Args[0]) {
+	case "zfs":
+		os.Exit(platformtest.RunInterposer("zfs"))
+	case "zpool":
+		os.Exit(platformtest.RunInterposer("zpool"))
+	}
 
+	// Test harness mode
 	var args HarnessArgs
-
+	flag.BoolVar(&args.NoInterposer, "no-interposer", false, "skip safety interposer; symlink zfs/zpool directly to real binaries (requires running as root)")
-	flag.StringVar(&args.CreateArgs.PoolName, "poolname", "", "")
-	flag.StringVar(&args.CreateArgs.ImagePath, "imagepath", "", "")
-	flag.Int64Var(&args.CreateArgs.ImageSize, "imagesize", DefaultPoolImageSize, "")
-	flag.StringVar(&args.CreateArgs.Mountpoint, "mountpoint", "", "")
 	flag.BoolVar(&args.StopAndKeepPoolOnFail, "failure.stop-and-keep-pool", false, "if a test case fails, stop test execution and keep pool as it was when the test failed")
-	flag.StringVar(&args.Run, "run", "", "")
+	flag.StringVar(&args.Run, "run", "", "regex to filter test cases")
 	flag.DurationVar(&platformtest.ZpoolExportTimeout, "zfs.zpool-export-timeout", platformtest.ZpoolExportTimeout, "")
 	flag.Parse()
 
@@ -49,7 +54,7 @@ func main() {
 var exitWithErr = fmt.Errorf("exit with error")
 
 type HarnessArgs struct {
-	CreateArgs            platformtest.ZpoolCreateArgs
+	NoInterposer          bool
 	StopAndKeepPoolOnFail bool
 	Run                   string
 }
@@ -90,6 +95,14 @@ func (i *invocation) RegisterChild(c *invocation) error {
 
 func HarnessRun(args HarnessArgs) error {
 
+	// Set up interposer: create symlinks and replace PATH.
+	// In direct mode, zfs/zpool symlink to real binaries (no sudo, no validation).
+	_, cleanup, err := platformtest.SetupInterposerPath("", args.NoInterposer)
+	if err != nil {
+		return errors.Wrap(err, "set up interposer PATH")
+	}
+	defer cleanup()
+
 	runRE := regexp.MustCompile(args.Run)
 
 	outlets := logger.NewOutlets()
@@ -104,11 +117,6 @@ func HarnessRun(args HarnessArgs) error {
 	}
 	outlets.Add(outlet, level)
 	logger := logger.NewLogger(outlets, 1*time.Second)
-
-	if err := args.CreateArgs.Validate(); err != nil {
-		logger.Error(err.Error())
-		panic(err)
-	}
 	ctx := context.Background()
 	defer trace.WithTaskFromStackUpdateCtx(&ctx)()
 	ctx = logging.WithLoggers(ctx, logging.SubsystemLoggersWithUniversalLogger(logger))
@@ -128,14 +136,13 @@ func HarnessRun(args HarnessArgs) error {
 
 		bold.Printf("BEGIN TEST CASE %s\n", inv)
 
-		pool, err := platformtest.CreateOrReplaceZpool(ctx, ex, args.CreateArgs)
+		if err := platformtest.CreateOrReplaceZpool(ctx, ex); err != nil {
-		if err != nil {
 			panic(errors.Wrap(err, "create test pool"))
 		}
 
 		ctx := &platformtest.Context{
 			Context:     ctx,
-			RootDataset: filepath.Join(pool.Name(), "rootds"),
+			RootDataset: filepath.Join(platformtest.PlatformTestPoolName, "rootds"),
 			QueueSubtest: func(id string, stf func(*platformtest.Context)) {
 				stinv := newInvocation(stf, id)
 				err := inv.RegisterChild(stinv)
@@ -158,7 +165,7 @@ func HarnessRun(args HarnessArgs) error {
 			return exitWithErr
 		}
 
-		if err := pool.Destroy(ctx, ex); err != nil {
+		if err := platformtest.DestroyZpool(ctx, ex); err != nil {
 			panic(fmt.Sprintf("error destroying test pool: %s", err))
 		}
 

internal/platformtest/harness/harness_test.go

@@ -3,8 +3,11 @@ package main
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
+
+	"github.com/zrepl/zrepl/internal/platformtest"
 )
 
 // Idea taken from
@@ -12,16 +15,22 @@ import (
 //
 /* How to generate coverage:
    go test -c -covermode=atomic -cover -coverpkg github.com/zrepl/zrepl/...
-   sudo ../logmockzfs/logzfsenv /tmp/zrepl_platform_test.log /usr/bin/zfs \
+   ./harness.test -test.coverprofile=/tmp/harness.out \
-       ./harness.test -test.coverprofile=/tmp/harness.out \
+       -test.v __DEVEL--i-heard-you-like-tests
-       -test.v __DEVEL--i-heard-you-like-tests \
-       -imagepath /tmp/testpool.img -poolname zreplplatformtest
     go tool cover -html=/tmp/harness.out -o /tmp/harness.html
 */
 // Merge with existing coverage reports using gocovmerge:
 //  https://github.com/wadey/gocovmerge
 
 func TestMain(t *testing.T) {
+	// Multi-personality: when invoked as zfs/zpool symlink, run interposer
+	switch filepath.Base(os.Args[0]) {
+	case "zfs":
+		os.Exit(platformtest.RunInterposer("zfs"))
+	case "zpool":
+		os.Exit(platformtest.RunInterposer("zpool"))
+	}
+
 	fmt.Println("incoming args: ", os.Args)
 
 	var (

internal/platformtest/interposer.go

@@ -0,0 +1,322 @@
+// # Safety Interposer
+//
+// The platformtest binary is a multi-personality binary (busybox-style).
+// When invoked as "zfs" or "zpool" (via argv[0]), it acts as a safety
+// interposer that validates commands and delegates to the real binary
+// via sudo.
+//
+// SetupInterposerPath creates a temp directory with symlinks and replaces PATH:
+//   - zfs/zpool → the platformtest binary itself (interposer mode)
+//   - zfs.real/zpool.real → actual binaries (for delegation via sudo)
+//   - sudo/bash → real binaries (so they remain accessible)
+//
+// When invoked as zfs or zpool, the binary validates that all commands
+// reference the test pool "zreplplatformtest" before delegating through
+// sudo. The validation rule is simple: the pool name must appear in the
+// command args. Special cases:
+//   - Resume tokens ("zfs send -t <token>"): decoded via the real binary
+//     to extract and verify the toname field
+//   - The -a (all) flag is blocked without an explicit pool reference
+//   - Bare subcommands (feature detection) are allowed
+//   - Mountpoint paths are validated against traversal on post-create chmod
+//
+// With -no-interposer, zfs/zpool symlink directly to the real binaries
+// (no sudo, no validation). Use this when running as root.
+package platformtest
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+// SetupInterposerPath creates a temp directory with zfs/zpool symlinks
+// and replaces PATH so that all zfs/zpool invocations go through it.
+//
+// If `explicitDir` is non-empty, the PATH is constructed in that directory
+// instead of a temp directory, and the caller is responsible for cleanup.
+//
+// `direct` controls whether to set up the interposer (false) or to symlink
+// zfs/zpool directly to the real binaries (true, no interposer, no sudo).
+//
+// Returns the directory path and a cleanup function.
+func SetupInterposerPath(explicitDir string, direct bool) (string, func(), error) {
+	// Resolve real binary paths while original PATH is still intact.
+	lookupNames := []string{"zfs", "zpool", "bash"}
+	if !direct {
+		lookupNames = append(lookupNames, "sudo")
+	}
+	realBinaries := make(map[string]string)
+	for _, name := range lookupNames {
+		p, err := exec.LookPath(name)
+		if err != nil {
+			return "", nil, fmt.Errorf("find real %s binary: %w", name, err)
+		}
+		realBinaries[name] = p
+	}
+
+	var dir string
+	var cleanup func()
+
+	if explicitDir != "" {
+		dir = explicitDir
+		cleanup = func() {} // caller manages lifecycle
+	} else {
+		var err error
+		dir, err = os.MkdirTemp("", "zrepl-platformtest-*")
+		if err != nil {
+			return "", nil, fmt.Errorf("create interposer dir: %w", err)
+		}
+		cleanup = func() { os.RemoveAll(dir) }
+	}
+
+	if direct {
+		// Direct mode: symlink zfs/zpool to real binaries (no interposer).
+		for _, name := range []string{"zfs", "zpool", "bash"} {
+			link := filepath.Join(dir, name)
+			os.Remove(link)
+			if err := os.Symlink(realBinaries[name], link); err != nil {
+				cleanup()
+				return "", nil, fmt.Errorf("create symlink %s: %w", name, err)
+			}
+		}
+	} else {
+		// Interposer mode: symlink zfs/zpool to self, .real to actual binaries.
+		self, err := os.Executable()
+		if err != nil {
+			cleanup()
+			return "", nil, fmt.Errorf("get executable path: %w", err)
+		}
+
+		for _, name := range []string{"zfs", "zpool"} {
+			link := filepath.Join(dir, name)
+			os.Remove(link)
+			if err := os.Symlink(self, link); err != nil {
+				cleanup()
+				return "", nil, fmt.Errorf("create symlink %s: %w", name, err)
+			}
+			realLink := filepath.Join(dir, name+".real")
+			os.Remove(realLink)
+			if err := os.Symlink(realBinaries[name], realLink); err != nil {
+				cleanup()
+				return "", nil, fmt.Errorf("create symlink %s.real: %w", name, err)
+			}
+		}
+
+		// Symlink other required binaries so they remain accessible
+		// after PATH replacement.
+		for _, name := range []string{"sudo", "bash"} {
+			link := filepath.Join(dir, name)
+			os.Remove(link)
+			if err := os.Symlink(realBinaries[name], link); err != nil {
+				cleanup()
+				return "", nil, fmt.Errorf("create symlink %s: %w", name, err)
+			}
+		}
+	}
+
+	// Replace PATH entirely so ALL zfs/zpool calls go through this directory.
+	os.Setenv("PATH", dir)
+
+	return dir, cleanup, nil
+}
+
+// RunInterposer handles the zfs/zpool interposer mode.
+// It validates that the command references the test pool,
+// then executes the real binary via sudo using the .real
+// symlink placed by SetupInterposerPath.
+func RunInterposer(command string) int {
+	args := os.Args[1:]
+
+	if err := validatePoolName(command, args, PlatformTestPoolName); err != nil {
+		fmt.Fprintf(os.Stderr, "SAFETY: %v\n", err)
+		return 1
+	}
+
+	// The .real symlink in PATH points to the actual binary.
+	// sudo follows the symlink, so no explicit resolution needed.
+	realBinary := filepath.Join(os.Getenv("PATH"), command+".real")
+	sudoArgs := append([]string{realBinary}, args...)
+	cmd := exec.Command("sudo", sudoArgs...)
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	err := cmd.Run()
+
+	// After a successful create, chmod the mountpoint so the
+	// unprivileged test user can operate on it.
+	if err == nil && isCreateOperation(args) {
+		if mountpoint := extractCreateMountpoint(command, args); mountpoint != "" {
+			chmodMountpoint(mountpoint)
+		}
+	}
+
+	if err != nil {
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			return exitErr.ExitCode()
+		}
+		fmt.Fprintf(os.Stderr, "interposer: exec error: %v\n", err)
+		return 1
+	}
+	return 0
+}
+
+func validatePoolName(command string, args []string, poolName string) error {
+	if len(args) == 0 {
+		return nil
+	}
+
+	// Check if any non-flag argument references the pool name.
+	for _, arg := range args {
+		if strings.HasPrefix(arg, "-") {
+			continue
+		}
+		if arg == poolName || strings.HasPrefix(arg, poolName+"/") || strings.HasPrefix(arg, poolName+"@") || strings.HasPrefix(arg, poolName+"#") {
+			return nil
+		}
+	}
+
+	// Special case: "zfs send -t <token>" (or -nvt, etc.) — the pool
+	// name is encoded in the resume token, not visible in the args.
+	// Decode the token via the real binary and verify toname.
+	if command == "zfs" {
+		if token := extractResumeToken(args); token != "" {
+			return validateResumeTokenPool(token, poolName)
+		}
+	}
+
+	// Block -a (all) flag without pool reference. Commands like
+	// "zfs unmount -a" or "zpool export -a" affect all pools.
+	for _, arg := range args {
+		if !strings.HasPrefix(arg, "-") {
+			continue
+		}
+		if arg == "-a" || (len(arg) > 2 && arg[0] == '-' && arg[1] != '-' &&
+			strings.ContainsRune(arg[1:], 'a')) {
+			return fmt.Errorf("%s command rejected: -a flag not allowed without explicit pool reference", command)
+		}
+	}
+
+	// If only one non-flag arg is present (the subcommand itself),
+	// this is feature detection (e.g., bare "zfs send", "zfs receive").
+	nonFlagArgs := 0
+	for _, arg := range args {
+		if !strings.HasPrefix(arg, "-") {
+			nonFlagArgs++
+		}
+	}
+	if nonFlagArgs <= 1 {
+		return nil
+	}
+
+	return fmt.Errorf("%s command rejected: args %v do not reference pool %q", command, args, poolName)
+}
+
+// extractResumeToken returns the resume token from "zfs send -t <token>"
+// or combined forms like "zfs send -nvt <token>". Returns "" if not found.
+func extractResumeToken(args []string) string {
+	if len(args) == 0 || args[0] != "send" {
+		return ""
+	}
+	for i, arg := range args {
+		if !strings.HasPrefix(arg, "-") {
+			continue
+		}
+		// -t standalone, or combined flag containing t (e.g., -nvt)
+		if arg == "-t" || (len(arg) > 2 && arg[0] == '-' && arg[1] != '-' &&
+			strings.ContainsRune(arg[1:], 't')) {
+			if i+1 < len(args) {
+				return args[i+1]
+			}
+		}
+	}
+	return ""
+}
+
+// validateResumeTokenPool decodes a resume token by calling the real zfs
+// binary directly (bypassing the interposer) and checks that the toname
+// field references the expected pool.
+func validateResumeTokenPool(token, poolName string) error {
+	realBinary := filepath.Join(os.Getenv("PATH"), "zfs.real")
+	cmd := exec.Command("sudo", realBinary, "send", "-nvt", token)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		// zfs send -nvt may exit non-zero if the dataset no longer exists,
+		// but it still prints the token contents. Only fail on exec errors.
+		if _, ok := err.(*exec.ExitError); !ok {
+			return fmt.Errorf("decode resume token: %w", err)
+		}
+	}
+
+	for _, line := range strings.Split(string(output), "\n") {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "toname = ") {
+			toname := strings.TrimPrefix(line, "toname = ")
+			if toname == poolName || strings.HasPrefix(toname, poolName+"/") || strings.HasPrefix(toname, poolName+"@") {
+				return nil
+			}
+			return fmt.Errorf("resume token rejected: toname %q does not reference pool %q", toname, poolName)
+		}
+	}
+
+	return fmt.Errorf("resume token rejected: could not extract toname from token")
+}
+
+func isCreateOperation(args []string) bool {
+	return len(args) > 0 && args[0] == "create"
+}
+
+func extractCreateMountpoint(command string, args []string) string {
+	switch command {
+	case "zpool":
+		// zpool create ... -O mountpoint=<path> ...
+		for i, arg := range args {
+			if arg == "-O" && i+1 < len(args) {
+				if strings.HasPrefix(args[i+1], "mountpoint=") {
+					return strings.TrimPrefix(args[i+1], "mountpoint=")
+				}
+			}
+		}
+	case "zfs":
+		// zfs create [-p] [-o ...] <dataset>
+		// Dataset is the last non-flag argument. Its mountpoint is
+		// derived from the pool mountpoint + dataset path suffix.
+		dataset := ""
+		skipNext := false
+		for _, arg := range args[1:] { // skip "create"
+			if skipNext {
+				skipNext = false
+				continue
+			}
+			if arg == "-o" {
+				skipNext = true
+				continue
+			}
+			if strings.HasPrefix(arg, "-") {
+				continue
+			}
+			dataset = arg
+		}
+		if dataset != "" && strings.HasPrefix(dataset, PlatformTestPoolName+"/") {
+			suffix := strings.TrimPrefix(dataset, PlatformTestPoolName)
+			return PlatformTestMountpoint + suffix
+		}
+	}
+	return ""
+}
+
+func chmodMountpoint(mountpoint string) {
+	// Validate: only chmod paths under the test mountpoint to prevent
+	// path traversal (e.g., dataset "pool/../../etc" -> mountpoint "/etc").
+	cleaned := filepath.Clean(mountpoint)
+	if cleaned != PlatformTestMountpoint && !strings.HasPrefix(cleaned, PlatformTestMountpoint+"/") {
+		fmt.Fprintf(os.Stderr, "interposer: refusing to chmod %q (not under %s)\n",
+			mountpoint, PlatformTestMountpoint)
+		return
+	}
+	// Best-effort: make mountpoint accessible to unprivileged user.
+	exec.Command("sudo", "chmod", "0777", cleaned).Run() //nolint:errcheck
+}

internal/platformtest/logmockzfs/logzfsenv

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -ue
-export ZREPL_MOCK_ZFS_COMMAND_LOG="$1"
-shift
-export ZREPL_MOCK_ZFS_PATH="$1"
-shift
-dirname="$(dirname "${BASH_SOURCE[0]}")"
-# If we invoke this script from the top zrepl source tree, like so:
-#    ./platformtest/logmockzfs/logzfsenv ...
-# then dirname is relative, i.e., ./platformtest/logmockzfs.
-# If we put that relative dir in PATH, then Go >= 1.19 will refuse to
-# exec the `./platformtest/logmockzfs/zfs` wrapper script if it finds
-# it via PATH lookup. For Example:
-#   cmd := exec.Command("zfs")
-#   err := cmd.Run()
-# will fail with an error that errors.Is(err, exec.ErrDot), message:
-#   cannot run executable found relative to current directory
-# The solution is to use an abspath.
-# Learn more at https://pkg.go.dev/os/exec#hdr-Executables_in_the_current_directory
-# and https://go-review.googlesource.com/c/go/+/381374
-absdirname="$(readlink -e "$dirname")"
-export PATH="$absdirname":"$PATH"
-args=("$@")
-exec "${args[@]}"

internal/platformtest/logmockzfs/zfs

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-args=("$@")
-
-if [ -n "$ZREPL_MOCK_ZFS_COMMAND_LOG" ]; then
-    (
-        flock -x 200
-        jq --compact-output -n --argjson args "$(printf '%s\0' "${args[@]}" | jq -Rsc 'split("\u0000")')" '{date: now|strflocaltime("%Y-%m-%dT%H:%M:%S"), command: $args}' >> "$ZREPL_MOCK_ZFS_COMMAND_LOG"
-    ) 200>"$ZREPL_MOCK_ZFS_COMMAND_LOG".lock
-fi
-
-exec "$ZREPL_MOCK_ZFS_PATH" "${args[@]}"

internal/platformtest/platformtest_zpool.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"path/filepath"
 	"runtime"
 	"strings"
 	"time"
@@ -14,97 +13,63 @@ import (
 	"github.com/zrepl/zrepl/internal/zfs"
 )
 
+const (
+	PlatformTestPoolName   = "zreplplatformtest"
+	PlatformTestImagePath  = "/tmp/zreplplatformtest.pool.img"
+	PlatformTestMountpoint = "/tmp/zreplplatformtest.pool"
+	PlatformTestImageSize  = 200 * (1 << 20) // 200 MiB
+)
+
 var ZpoolExportTimeout time.Duration = 500 * time.Millisecond
 
-type Zpool struct {
+func CreateOrReplaceZpool(ctx context.Context, e Execer) error {
-	args ZpoolCreateArgs
-}
-
-type ZpoolCreateArgs struct {
-	PoolName   string
-	ImagePath  string
-	ImageSize  int64
-	Mountpoint string
-}
-
-func (a ZpoolCreateArgs) Validate() error {
-	if !filepath.IsAbs(a.ImagePath) {
-		return errors.Errorf("ImagePath must be absolute, got %q", a.ImagePath)
-	}
-	const minImageSize = 1024
-	if a.ImageSize < minImageSize {
-		return errors.Errorf("ImageSize must be > %v, got %v", minImageSize, a.ImageSize)
-	}
-	if a.Mountpoint == "" || a.Mountpoint[0] != '/' {
-		return errors.Errorf("Mountpoint must be an absolute path to a directory")
-	}
-	if a.PoolName == "" {
-		return errors.Errorf("PoolName must not be empty")
-	}
-	return nil
-}
-
-func CreateOrReplaceZpool(ctx context.Context, e Execer, args ZpoolCreateArgs) (*Zpool, error) {
-	if err := args.Validate(); err != nil {
-		return nil, errors.Wrap(err, "zpool create args validation error")
-	}
-
 	// export pool if it already exists (idempotence)
-	if _, err := zfs.ZFSGetRawAnySource(ctx, args.PoolName, []string{"name"}); err != nil {
+	if _, err := zfs.ZFSGetRawAnySource(ctx, PlatformTestPoolName, []string{"name"}); err != nil {
 		if _, ok := err.(*zfs.DatasetDoesNotExist); ok {
 			// we'll create it shortly
 		} else {
-			return nil, errors.Wrapf(err, "cannot determine whether test pool %q exists", args.PoolName)
+			return errors.Wrapf(err, "cannot determine whether test pool %q exists", PlatformTestPoolName)
 		}
 	} else {
 		// exists, export it, OpenFile will destroy it
-		if err := e.RunExpectSuccessNoOutput(ctx, "zpool", "export", args.PoolName); err != nil {
+		if err := e.RunExpectSuccessNoOutput(ctx, "zpool", "export", PlatformTestPoolName); err != nil {
-			return nil, errors.Wrapf(err, "cannot destroy test pool %q", args.PoolName)
+			return errors.Wrapf(err, "cannot destroy test pool %q", PlatformTestPoolName)
 		}
 	}
 
-	// clear the mountpoint dir
-	if err := os.RemoveAll(args.Mountpoint); err != nil {
-		return nil, errors.Wrapf(err, "remove mountpoint dir %q", args.Mountpoint)
-	}
-	if err := os.Mkdir(args.Mountpoint, 0700); err != nil {
-		return nil, errors.Wrapf(err, "create mountpoint dir %q", args.Mountpoint)
-	}
-
 	// idempotently (re)create the pool image
-	image, err := os.OpenFile(args.ImagePath, os.O_CREATE|os.O_RDWR, 0600)
+	image, err := os.OpenFile(PlatformTestImagePath, os.O_CREATE|os.O_RDWR, 0600)
 	if err != nil {
-		return nil, errors.Wrap(err, "create image file")
+		return errors.Wrap(err, "create image file")
 	}
 	defer image.Close()
-	if err := image.Truncate(args.ImageSize); err != nil {
+	if err := image.Truncate(PlatformTestImageSize); err != nil {
-		return nil, errors.Wrap(err, "create image: truncate")
+		return errors.Wrap(err, "create image: truncate")
 	}
 	image.Close()
 
-	// create the pool
+	// create the pool (zpool runs via sudo through the interposer,
+	// which creates the mountpoint and chmods it to 0777)
 	err = e.RunExpectSuccessNoOutput(ctx, "zpool", "create", "-f",
-		"-O", fmt.Sprintf("mountpoint=%s", args.Mountpoint),
+		"-O", fmt.Sprintf("mountpoint=%s", PlatformTestMountpoint),
-		args.PoolName, args.ImagePath,
+		PlatformTestPoolName, PlatformTestImagePath,
 	)
 	if err != nil {
-		return nil, errors.Wrap(err, "zpool create")
+		return errors.Wrap(err, "zpool create")
 	}
 
-	return &Zpool{args}, nil
+	return nil
 }
 
-func (p *Zpool) Name() string { return p.args.PoolName }
+func DestroyZpool(ctx context.Context, e Execer) error {
-
-func (p *Zpool) Destroy(ctx context.Context, e Execer) error {
 
 	exportDeadline := time.Now().Add(ZpoolExportTimeout)
 
 	for {
 		if time.Now().After(exportDeadline) {
-			return errors.Errorf("could not zpool export (got 'pool is busy'): %s", p.args.PoolName)
+			return errors.Errorf("could not zpool export (got 'pool is busy'): %s", PlatformTestPoolName)
 		}
-		err := e.RunExpectSuccessNoOutput(ctx, "zpool", "export", p.args.PoolName)
+		err := e.RunExpectSuccessNoOutput(ctx, "zpool", "export", PlatformTestPoolName)
 		if err == nil {
 			break
 		}
@@ -113,17 +78,13 @@ func (p *Zpool) Destroy(ctx context.Context, e Execer) error {
 			continue
 		}
 		if err != nil {
-			return errors.Wrapf(err, "export pool %q", p.args.PoolName)
+			return errors.Wrapf(err, "export pool %q", PlatformTestPoolName)
 		}
 	}
 
-	if err := os.Remove(p.args.ImagePath); err != nil {
+	if err := os.Remove(PlatformTestImagePath); err != nil {
 		return errors.Wrapf(err, "remove pool image")
 	}
 
-	if err := os.RemoveAll(p.args.Mountpoint); err != nil {
-		return errors.Wrapf(err, "remove mountpoint dir %q", p.args.Mountpoint)
-	}
-
 	return nil
 }

internal/platformtest/tests/replication.go

@@ -573,9 +573,8 @@ func implReplicationIsResumableFullSend(ctx *platformtest.Context, setup replica
 			// due to step holds
 			if setup.expectDatasetIsBusyErrorWhenDestroySnapshotWhilePartiallyReplicated {
 				ctx.Logf("i=%v", i)
-				dse, ok := err.(*zfs.DestroySnapshotsError)
+				require.Error(ctx, err)
-				require.True(ctx, ok, "expected *zfs.DestroySnapshotsError, got %T: %s", err, err)
+				require.Contains(ctx, err.Error(), "dataset is busy")
-				require.True(ctx, dse.AllReasonIsHold(), "expected hold reason, got %v", dse.Reason)
 			}
 		}
 
@@ -757,13 +756,11 @@ func ReplicationIncrementalDestroysStepHoldsIffIncrementalStepHoldsAreDisabledBu
 func ReplicationStepCompletedLostBehavior__GuaranteeResumability(ctx *platformtest.Context) {
 	scenario := replicationStepCompletedLostBehavior_impl(ctx, pdu.ReplicationGuaranteeKind_GuaranteeResumability)
 
-	dse1, ok := scenario.deleteSfs1Err.(*zfs.DestroySnapshotsError)
+	require.Error(ctx, scenario.deleteSfs1Err, "protected by holds")
-	require.True(ctx, ok, "expected *zfs.DestroySnapshotsError, got %T: %s", scenario.deleteSfs1Err, scenario.deleteSfs1Err)
+	require.Contains(ctx, scenario.deleteSfs1Err.Error(), "dataset is busy")
-	require.True(ctx, dse1.AllReasonIsHold(), "expected hold reason, got %v", dse1.Reason)
 
-	dse2, ok := scenario.deleteSfs2Err.(*zfs.DestroySnapshotsError)
+	require.Error(ctx, scenario.deleteSfs2Err, "protected by holds")
-	require.True(ctx, ok, "expected *zfs.DestroySnapshotsError, got %T: %s", scenario.deleteSfs2Err, scenario.deleteSfs2Err)
+	require.Contains(ctx, scenario.deleteSfs2Err.Error(), "dataset is busy")
-	require.True(ctx, dse2.AllReasonIsHold(), "expected hold reason, got %v", dse2.Reason)
 
 	require.Nil(ctx, scenario.finalReport.Error())
 	_ = fsversion(ctx, scenario.rfs, "@3") // @3 ade it to the other side

internal/platformtest/tests/undestroyableSnapshotParsing.go

@@ -31,7 +31,7 @@ func UndestroyableSnapshotParsing(t *platformtest.Context) {
 			panic(dse.Filesystem)
 		}
 		require.Equal(t, []string{"4 5 6"}, dse.Undestroyable)
-		require.True(t, dse.AllReasonIsHold(), "expected hold reason, got %v", dse.Reason)
+		require.Equal(t, []string{"dataset is busy"}, dse.Reason)
 	}
 
 }

internal/zfs/zfs.go

@@ -1723,20 +1723,6 @@ type DestroySnapshotsError struct {
 	Reason        []string
 }
 
-var destroySnapshotsReasonHeldRegexp = regexp.MustCompile(`^it's being held\. Run 'zfs holds -r .+' to see holders\.$`)
-
-// AllReasonIsHold returns true if every undestroyable snapshot failed because
-// it is held. ZFS < 2.4 reports "dataset is busy", ZFS >= 2.4 reports
-// "it's being held. Run 'zfs holds -r <snapshot>' to see holders."
-func (e *DestroySnapshotsError) AllReasonIsHold() bool {
-	for _, r := range e.Reason {
-		if r != "dataset is busy" && !destroySnapshotsReasonHeldRegexp.MatchString(r) {
-			return false
-		}
-	}
-	return true
-}
-
 func (e *DestroySnapshotsError) Error() string {
 	if len(e.Undestroyable) != len(e.Reason) {
 		panic(fmt.Sprintf("%v != %v", len(e.Undestroyable), len(e.Reason)))

packaging/rpm/zrepl.spec

@@ -69,7 +69,7 @@ cp -a   internal/config/samples                         %{buildroot}%{_datadir}/
 %{_bindir}/zrepl
 %config %{_unitdir}/zrepl.service
 %dir %{_sysconfdir}/zrepl
-%config(noreplace) %{_sysconfdir}/zrepl/zrepl.yml
+%config %{_sysconfdir}/zrepl/zrepl.yml
 %{_datadir}/zsh/site-functions/_zrepl
 %{_datadir}/bash-completion/completions/zrepl
 %{_datadir}/doc/zrepl