pub const ENV_ROUTINE: [&str; 4];Expand description
The refused names that mean nothing at all, because OpenSSH sends them on its own without being asked.
Still refused — ENV_ALLOWLIST is unchanged and this list grants nothing.
What it changes is the level the refusal is reported at, and the reason it
has to exist is a measurement.
MEASURED on the reference desktop 2026-08-05, an 18-repository ingest over real SSH with stock
git 2.53.0 as the client, 203 connections, RUST_LOG=info:
| WARN lines | of which ssh.env.refused for LANG/COLORTERM |
|---|---|
| 406 | 406 (100%) |
Zero warnings of any other kind were emitted in the whole run. OpenSSH’s
shipped ssh_config carries SendEnv LANG LC_*, and desktop terminals add
COLORTERM, so every git over ssh produces two of these before it has
asked for anything. An operator who greps for WARN on a live gunnar
therefore reads noise at a 100% false-positive rate and will not see the
first real one — which is the same disease as a check that cannot go red,
wearing the other colour.
A client naming something NOT on this list is a different event and keeps
its warn: LD_PRELOAD, PATH, GIT_DIR, GIT_ALTERNATE_OBJECT_DIRECTORIES
are what an attacker tries, and nothing sends them by accident.