Find rsync in PATH and pass the SSH password only to rsync

A missing /usr/bin/rsync ended in a traceback, possibly after --remove-before-backup had removed old backups, and left SSHPASS in the environment.

tests/test_remote.py

@@ -254,9 +254,11 @@ class RecordPopen:
 
     returncode = 0
     calls: list[list[str]] = []
+    envs: list[dict[str, str] | None] = []
 
     def __init__(self, args: list[str], **kwargs: Any) -> None:
         RecordPopen.calls.append(args)
+        RecordPopen.envs.append(kwargs.get('env'))
         self.stdin = io.BytesIO()
         self.stdout = io.BytesIO(b'sent 1 bytes  received 2 bytes\ntotal size is 3\n')
 
@@ -276,6 +278,7 @@ class TestRsyncArgs:
     def record_popen(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
         RecordPopen.returncode = 0
         RecordPopen.calls = []
+        RecordPopen.envs = []
         monkeypatch.setattr(sb, 'Popen', RecordPopen)
         # The input must exist locally
         (tmp_path / 'input').mkdir()
@@ -322,19 +325,26 @@ class TestRsyncArgs:
 
     def test_password_auth(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
         monkeypatch.setattr(sb, 'which', lambda cmd: f'/usr/bin/{cmd}')
-        monkeypatch.setenv('SSHPASS', 'secret')
+        monkeypatch.delenv('SSHPASS', raising=False)
         backup = connected_backup()
         backup.inputs = [str(tmp_path / 'input')]
-        backup._password_auth = True
+        backup._password = 'secret'
 
         assert backup.run() == 0
 
         (args,) = RecordPopen.calls
         assert shlex.split(self.ssh_command(args)) == ['sshpass', '-e', 'ssh', '-l', 'user', '-o',
                                                        'StrictHostKeyChecking=accept-new']
-        # The password must not stay in the environment
+        # Only rsync gets the password, never our own environment
+        (env,) = RecordPopen.envs
+        assert env is not None and env['SSHPASS'] == 'secret'
         assert 'SSHPASS' not in os.environ
 
+    def test_no_password_env(self, tmp_path: Path) -> None:
+        self.run(tmp_path)
+
+        assert RecordPopen.envs == [None]
+
     def test_failure(self, tmp_path: Path, remote_home: Path) -> None:
         base = make_backups(remote_home, '2026-10-01_10-00-00')
         RecordPopen.returncode = 23
@@ -471,13 +481,13 @@ class TestLogin:
     def test_password(self, client: FakeClient, monkeypatch: pytest.MonkeyPatch) -> None:
         client.outcomes = [ssh_error(), ssh_error(), None]
         monkeypatch.setattr(sb, 'getpass', lambda prompt: 'secret')
-        monkeypatch.setenv('SSHPASS', '')
+        monkeypatch.delenv('SSHPASS', raising=False)
         backup = remote_backup()
 
         assert backup._ssh_connect() is client
         assert client.connects[-1]['password'] == 'secret'
-        assert backup._password_auth
-        assert os.environ['SSHPASS'] == 'secret'
+        assert backup._password == 'secret'
+        assert 'SSHPASS' not in os.environ
 
     def test_wrong_password(self, client: FakeClient, monkeypatch: pytest.MonkeyPatch) -> None:
         client.outcomes = [ssh_error(), ssh_error(), ssh_error()]