release: 0.7.2 — crate replicate (ZFS storage replication via ssh)

[click0]

Summary

crate replicate <jail> --to [user@]host --dest-dataset <ds> — takes a fresh snapshot of a jail's dataset and streams it to a remote host via zfs send | ssh ... 'zfs recv'. Supports incremental sends (--since / --auto-incremental).

crate replicate myjail \
    --to backup@dr.example.com \
    --dest-dataset tank/jails/myjail \
    --auto-incremental \
    --ssh-port 2222 \
    --ssh-key /root/.ssh/id_ed25519 \
    --ssh-opt StrictHostKeyChecking=accept-new \
    --ssh-opt ConnectTimeout=30

SSH transport — what operators can drive

Flag	Purpose
--ssh-port N	non-default port
--ssh-key PATH	identity file (-i)
--ssh-config PATH	custom ssh_config (-F)
--ssh-opt KEY=VAL	repeatable; passed verbatim as -o KEY=VAL

--ssh-opt is the deliberate escape hatch — StrictHostKeyChecking, UserKnownHostsFile, ProxyJump, ConnectTimeout, etc. all thread through.

Defaults: BatchMode=yes (no password prompts in cron), ServerAliveInterval=30 (long sends stay alive across firewalls). Both overridable via --ssh-opt.

Defense in depth

Every input passes through pure validators before any filesystem/process touchpoint:

• --to — user must be alnum + ._-; host must be IPv4 with octet bounds (256.0.0.1 rejected) or RFC 1123 hostname; shell metacharacters rejected
• --dest-dataset — ZFS alphabet only (alnum + ._-/), no //, no ./.. segments
• --ssh-opt KEY=VAL — KEY alnum (≤64), VAL rejects whitespace, control chars, and shell metacharacters (values are passed unquoted to ssh)
• --ssh-key / --ssh-config — absolute paths, no .., no metas

Even with a compromised spec, worst case is a validate-style error — never ssh host '...; rm -rf /'.

Implementation

• lib/replicate_pure.{h,cpp} — pure SSH-side helpers (with the IPv4-shape fix from 0.6.10 reused), argv builders threading --ssh-* flags into correct ssh positions, buildReplicationPipeline for Util::execPipeline.
• lib/replicate.cpp — runtime: jail → dataset, latest backup-* for --auto-incremental, fresh snapshot, run pipeline. Reuses BackupPure::choosePlan + snapshotSuffix from 0.7.0.
• cli/args.cpp + main.cpp — CmdReplicate, usageReplicate(), all flags wired.
• lib/audit*.cpp — recorded; target <jail>-><[user@]host>:<dest-dataset>.

Tests

tests/unit/replicate_pure_test.cpp — 15 ATF cases:

• 2 validateSshRemote (typical/invalid incl. octet bounds, underscore-hostname, shell metas)
• 1 parseSshRemote user/host split
• 2 validateSshOpt (typical incl. real-world ssh options; invalid incl. ws, ctrl chars, metas)
• 2 validateSshKey (typical/invalid)
• 2 validateDestDataset (typical/invalid: //, ./.., :, metas)
• 3 buildSshArgv (minimal w/ defaults, full options, no-user)
• 1 buildRemoteRecvCommand
• 2 buildReplicationPipeline (full + incremental -i prev curr)

Verified locally: 15/15.

Test plan

• kyua test replicate_pure_test — 15/15
• Version bumped to 0.7.2
• TODO — replicate moved to Done

https://claude.ai/code/session_01X6t6tzVypHye5bDGLxzmZK

---

Generated by Claude Code