Harden remote verification against environment overrides and marker normalization

lib/common.sh

@@ -254,6 +254,20 @@ check_remote() {
   for key in ${!RCLONE_CONFIG_@}; do
     [[ $key == RCLONE_CONFIG_PASS ]] || die "Remote overrides through $key are unsupported; use the config file"
   done
+  # rclone reads global flags from exported RCLONE_* variables too. For example,
+  # RCLONE_SIZE_ONLY bypasses byte comparison even with check --download; filters
+  # can hide missing archives from both copy and check. Refuse such ambient flags
+  # before the first remote operation, rather than silently weakening verification.
+  # Allow only our explicit settings (passed as CLI flags) and config decryption.
+  while IFS= read -r key; do
+    [[ $key == RCLONE_* ]] || continue
+    case $key in
+      RCLONE_BIN|RCLONE_CONFIG|RCLONE_CONFIG_PASS|RCLONE_REMOTE_BASE|RCLONE_RETRIES|\
+      RCLONE_LOW_LEVEL_RETRIES|RCLONE_RETRIES_SLEEP|RCLONE_TIMEOUT|RCLONE_CONTIMEOUT|\
+      RCLONE_STATS_INTERVAL|RCLONE_TRANSFERS|RCLONE_CHECKERS|RCLONE_ONEDRIVE_CHUNK_SIZE|RCLONE_BWLIMIT) ;;
+      *) die "Unsupported rclone environment override: $key; use documented app-backup settings and the remote config" ;;
+    esac
+  done < <(compgen -e)
   # Pipe directly into the parser: compatibility with older rclone without
   # config redacted. Secret values never go to the log or a temporary file.
   "$RCLONE_BIN" --ask-password=false --config "$RCLONE_CONFIG" config show "$name" | helper crypt "$name"