From e6fc593f68815ad478b53866ac99f4cf31c114db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Mart=C3=AD?= <mvdan@mvdan.cc>
Date: Sun, 30 Apr 2023 14:42:00 +0100
Subject: [PATCH] set testscript's RequireExplicitExec and RequireUniqueNames

The first makes our test scripts more consistent, as all external
program executions happen via "exec" and are not as easily confused
with custom builtin commands like our "generate-literals".

The second catches mistakes if any of our txtar files have duplicate
files, where all but one of the contents would be ignored before.
---
 main_test.go                     |  4 ++-
 testdata/script/asm.txtar        |  8 +++---
 testdata/script/atomic.txtar     |  2 +-
 testdata/script/basic.txtar      |  4 +--
 testdata/script/cgo.txtar        |  6 ++---
 testdata/script/crossbuild.txtar |  2 +-
 testdata/script/debugdir.txtar   |  4 +--
 testdata/script/embed.txtar      |  2 +-
 testdata/script/gogarble.txtar   | 14 +++++-----
 testdata/script/goversion.txtar  | 24 ++++++++---------
 testdata/script/help.txtar       | 46 ++++++++++++++++----------------
 testdata/script/implement.txtar  |  2 +-
 testdata/script/imports.txtar    |  6 ++---
 testdata/script/init.txtar       |  2 +-
 testdata/script/ldflags.txtar    |  4 +--
 testdata/script/linker.txtar     |  4 +--
 testdata/script/linkname.txtar   |  2 +-
 testdata/script/list_error.txtar |  2 +-
 testdata/script/literals.txtar   |  8 +++---
 testdata/script/modinfo.txtar    |  2 +-
 testdata/script/plugin.txtar     |  4 +--
 testdata/script/position.txtar   |  2 +-
 testdata/script/reflect.txtar    |  2 +-
 testdata/script/reverse.txtar    | 16 +++++------
 testdata/script/run.txtar        |  4 +--
 testdata/script/seed-cache.txtar |  4 +--
 testdata/script/seed.txtar       | 14 +++++-----
 testdata/script/syntax.txtar     |  2 +-
 testdata/script/test.txtar       |  6 ++---
 testdata/script/tiny.txtar       |  4 +--
 testdata/script/typeparams.txtar |  2 +-
 31 files changed, 105 insertions(+), 103 deletions(-)

diff --git a/main_test.go b/main_test.go
index 5300c7e..ad52667 100644
--- a/main_test.go
+++ b/main_test.go
@@ -133,7 +133,9 @@ func TestScript(t *testing.T) {
 			"setenvfile":        setenvfile,
 			"grepfiles":         grepfiles,
 		},
-		UpdateScripts: *update,
+		UpdateScripts:       *update,
+		RequireExplicitExec: true,
+		RequireUniqueNames:  true,
 	}
 	if err := gotooltest.Setup(&p); err != nil {
 		t.Fatal(err)
diff --git a/testdata/script/asm.txtar b/testdata/script/asm.txtar
index 41820d7..f088370 100644
--- a/testdata/script/asm.txtar
+++ b/testdata/script/asm.txtar
@@ -3,13 +3,13 @@
 # TODO: support arm64, at least
 [!amd64] skip 'the assembly is only written for amd64'
 
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 ! binsubstr main$exe 'test/main' 'addJmp' 'AddImpl' 'garble_'
 
 # We used to panic on broken packages with assembly.
-! garble build ./broken/...
+! exec garble build ./broken/...
 stderr -count=1 'broken[/\\]asm[/\\].*MissingType'
 stderr -count=1 'broken[/\\]syntax[/\\].*unexpected newline'
 
@@ -18,10 +18,10 @@ stderr -count=1 'broken[/\\]syntax[/\\].*unexpected newline'
 # Ensure that reversing doesn't error with assembly files.
 # It should fail, as there is nothing to reverse, but without any parse error.
 stdin empty-reverse.txt
-! garble reverse .
+! exec garble reverse .
 ! stderr .
 
-garble -tiny build
+exec garble -tiny build
 exec ./main
 cmp stderr main.stderr
 ! binsubstr main$exe 'addJmp' 'AddImpl'
diff --git a/testdata/script/atomic.txtar b/testdata/script/atomic.txtar
index ba81ede..8e14e19 100644
--- a/testdata/script/atomic.txtar
+++ b/testdata/script/atomic.txtar
@@ -6,7 +6,7 @@
 [amd64] [!darwin] env GOARCH=386
 [arm64] [!darwin] env GOARCH=arm
 
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 
diff --git a/testdata/script/basic.txtar b/testdata/script/basic.txtar
index 79f4f80..b36dfb2 100644
--- a/testdata/script/basic.txtar
+++ b/testdata/script/basic.txtar
@@ -1,5 +1,5 @@
 # Check that the simplest use of garble works. Note the lack of a module or GOGARBLE.
-garble build -o=main$exe garble_main.go
+exec garble build -o=main$exe garble_main.go
 exec ./main
 cmp stderr main.stderr
 
@@ -37,7 +37,7 @@ stderr 'cannot open shared file.*did you run.*instead of "garble \[command\]"'
 # No packages should be rebuilt either, thanks to the build cache.
 cp main$exe main_old$exe
 rm main$exe
-garble build -v -o=main$exe garble_main.go
+exec garble build -v -o=main$exe garble_main.go
 ! stderr .
 bincmp main$exe main_old$exe
 
diff --git a/testdata/script/cgo.txtar b/testdata/script/cgo.txtar
index 4280d66..ff2b207 100644
--- a/testdata/script/cgo.txtar
+++ b/testdata/script/cgo.txtar
@@ -1,6 +1,6 @@
 [!cgo] skip 'this test requires cgo to be enabled'
 
-garble build
+exec garble build
 ! stderr 'warning' # check that the C toolchain is happy
 exec ./main
 cmp stdout main.stdout
@@ -13,11 +13,11 @@ env GARBLE_TEST_REVERSING=true
 exec ./main
 cp stdout reversing.stdout
 stdin reversing.stdout
-garble reverse .
+exec garble reverse .
 cmp stdout reversed.stdout
 env GARBLE_TEST_REVERSING=false
 
-garble -tiny build
+exec garble -tiny build
 exec ./main
 cmp stdout main.stdout
 
diff --git a/testdata/script/crossbuild.txtar b/testdata/script/crossbuild.txtar
index 32ed80b..aa08ca5 100644
--- a/testdata/script/crossbuild.txtar
+++ b/testdata/script/crossbuild.txtar
@@ -16,7 +16,7 @@
 [windows] env GOOS=linux
 [!arm] env GOARCH=arm
 [arm] env GOARCH=arm64
-garble build -gcflags=math/bits=-d=ssa/intrinsics/debug=1
+exec garble build -gcflags=math/bits=-d=ssa/intrinsics/debug=1
 stderr 'intrinsic substitution for Len64.*BitLen64'
 -- go.mod --
 module test/main
diff --git a/testdata/script/debugdir.txtar b/testdata/script/debugdir.txtar
index 31b278f..8a5271b 100644
--- a/testdata/script/debugdir.txtar
+++ b/testdata/script/debugdir.txtar
@@ -1,4 +1,4 @@
-garble -debugdir ./debug1 build
+exec garble -debugdir ./debug1 build
 exists 'debug1/test/main/imported/imported.go' 'debug1/test/main/main.go' 'debug1/reflect/type.go'
 exists 'debug1/runtime/map.go' 'debug1/runtime/funcdata.h' 'debug1/runtime/asm.s'
 [amd64] exists 'debug1/runtime/cpuflags_amd64.go' 'debug1/runtime/asm_amd64.s'
@@ -12,7 +12,7 @@ exists 'debug1/runtime/map.go' 'debug1/runtime/funcdata.h' 'debug1/runtime/asm.s
 # Sources from previous builds should be deleted
 cp $WORK/debug1/test/main/main.go $WORK/debug1/some_file_from_prev_build.go
 
-garble -debugdir ./debug1 build -v
+exec garble -debugdir ./debug1 build -v
 stderr 'test/main' # we force rebuilds with -debugdir
 ! exists $WORK/debug1/some_file_from_prev_build.go
 -- go.mod --
diff --git a/testdata/script/embed.txtar b/testdata/script/embed.txtar
index 85b242a..0b7ef3e 100644
--- a/testdata/script/embed.txtar
+++ b/testdata/script/embed.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 
 exec ./main
 cmp stdout main.stdout
diff --git a/testdata/script/gogarble.txtar b/testdata/script/gogarble.txtar
index 8b5f2dc..27a9f45 100644
--- a/testdata/script/gogarble.txtar
+++ b/testdata/script/gogarble.txtar
@@ -1,11 +1,11 @@
 # Ensure that "does not match any packages" works.
 env GOGARBLE=match-absolutely/nothing
-! garble build -o=out ./standalone
+! exec garble build -o=out ./standalone
 stderr '^GOGARBLE="match-absolutely/nothing" does not match any packages to be built$'
 
 # A build where just some packages are obfuscated.
 env GOGARBLE=test/main/imported
-garble -literals build -o=out ./importer
+exec garble -literals build -o=out ./importer
 
 ! binsubstr out 'some long string to obfuscate'
 binsubstr out 'some long string to not obfuscate'
@@ -14,7 +14,7 @@ binsubstr out 'some long string to not obfuscate'
 # Some of the imported std packages use "import maps" due to vendoring,
 # and a past bug made this case fail for "garble build".
 env GOGARBLE=test/main
-garble build -o=out ./stdimporter
+exec garble build -o=out ./stdimporter
 
 [short] stop # rebuilding std is slow
 
@@ -28,12 +28,12 @@ env GOGARBLE='*'
 # packages so we must properly support ImportMap.
 # Plus, some packages like net make heavy use of complex features like Cgo.
 # Note that we won't obfuscate a few std packages just yet, mainly those around runtime.
-garble build std
+exec garble build std
 
 # Link a binary importing net/http, which will catch whether or not we
 # support ImportMap when linking.
 # Also ensure we are obfuscating low-level std packages.
-garble build -o=out ./stdimporter
+exec garble build -o=out ./stdimporter
 ! binsubstr out 'http.ListenAndServe' 'debug.WriteHeapDump' 'time.Now' 'syscall.Listen'
 
 # The same low-level std packages appear in plain sight in regular builds.
@@ -45,8 +45,8 @@ binsubstr out_regular 'http.ListenAndServe' 'debug.WriteHeapDump' 'time.Now' 'sy
 # We also forcibly rebuild runtime on its own, given it used to be non-reproducible
 # due to its use of linknames pointing at std packages it doesn't depend upon.
 env GOCACHE=${WORK}/gocache-empty
-garble build -a runtime
-garble build -o=out_rebuild ./stdimporter
+exec garble build -a runtime
+exec garble build -o=out_rebuild ./stdimporter
 bincmp out_rebuild out
 -- go.mod --
 module test/main
diff --git a/testdata/script/goversion.txtar b/testdata/script/goversion.txtar
index c6b37e5..2ef4f67 100644
--- a/testdata/script/goversion.txtar
+++ b/testdata/script/goversion.txtar
@@ -6,74 +6,74 @@ env PATH=${WORK}/.bin${:}${PATH}
 
 # An empty go version.
 env TOOLCHAIN_GOVERSION=''
-! garble build
+! exec garble build
 stderr 'Go version is too old; please upgrade to Go 1\.20\.x or newer'
 
 # We should error on a devel version that's too old.
 # Note that they lacked the "goN.M-" prefix.
 env TOOLCHAIN_GOVERSION='devel +afb5fca Sun Aug 07 00:00:00 2020 +0000'
-! garble build
+! exec garble build
 stderr 'Go version is too old; please upgrade to Go 1\.20\.x or newer'
 
 # Another form of old version; with an old "goN.M-" prefix.
 env TOOLCHAIN_GOVERSION='devel go1.15-afb5fca Sun Aug 07 00:00:00 2020 +0000'
-! garble build
+! exec garble build
 stderr 'Go version "devel go1\.15-.*2020.*" is too old; please upgrade to Go 1\.20\.x'
 
 # A current devel version should be fine.
 # Note that we don't look at devel version timestamps.
 env GARBLE_TEST_GOVERSION='go1.20'
 env TOOLCHAIN_GOVERSION='devel go1.20-ad97d204f0 Sun Sep 12 16:46:58 2023 +0000'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # We should error on a stable version that's too old.
 env TOOLCHAIN_GOVERSION='go1.14'
-! garble build
+! exec garble build
 stderr 'Go version "go1\.14" is too old; please upgrade to Go 1\.20\.x or newer'
 
 # We should accept a future stable version.
 # Note that we need to bump the version of Go that supposedly built it, too.
 env GARBLE_TEST_GOVERSION='go1.28.2'
 env TOOLCHAIN_GOVERSION='go1.28.2'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # We should accept custom devel strings.
 env TOOLCHAIN_GOVERSION='devel go1.20-somecustomversion'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # The current toolchain may be older than the one that built garble.
 env GARBLE_TEST_GOVERSION='go1.21'
 env TOOLCHAIN_GOVERSION='go1.20.3'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # The current toolchain may be equal to the one that built garble.
 env GARBLE_TEST_GOVERSION='devel go1.20-6673d5d701 Sun Mar 20 16:05:03 2023 +0000'
 env TOOLCHAIN_GOVERSION='devel go1.20-6673d5d701 Sun Mar 20 16:05:03 2023 +0000'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 
 # The current toolchain must not be newer than the one that built garble.
 env GARBLE_TEST_GOVERSION='go1.18'
 env TOOLCHAIN_GOVERSION='go1.20.1'
-! garble build
+! exec garble build
 stderr 'garble was built with "go1\.18" and is being used with "go1\.20\.1"; please rebuild garble with the newer version'
 
 # We'll error even if the difference is a minor (bugfix) level.
 # In practice it probably wouldn't matter, but in theory it could still lead to tricky bugs.
 env GARBLE_TEST_GOVERSION='go1.20.11'
 env TOOLCHAIN_GOVERSION='go1.20.14'
-! garble build
+! exec garble build
 stderr 'garble was built with "go1\.20\.11" and is being used with "go1\.20\.14"; please rebuild garble with the newer version'
 
 # If garble builds itself and is then used, it won't know what version built it.
 # As a fallback, we drop the comparison against the toolchain's version.
 env GARBLE_TEST_GOVERSION='bogus version'
 env TOOLCHAIN_GOVERSION='go1.20.3'
-! garble build
+! exec garble build
 stderr 'mocking the real build'
 -- go.mod --
 module test/main
diff --git a/testdata/script/help.txtar b/testdata/script/help.txtar
index f4581dc..a6e982a 100644
--- a/testdata/script/help.txtar
+++ b/testdata/script/help.txtar
@@ -1,29 +1,29 @@
-! garble
+! exec garble
 stderr 'Garble obfuscates Go code'
 stderr 'garble \[garble flags\] command'
 ! stderr 'usage: go build'
 ! stdout .
 
-! garble -h
+! exec garble -h
 stderr 'Garble obfuscates Go code'
 stderr 'garble \[garble flags\] command'
 ! stdout .
 
-! garble help
+! exec garble help
 stderr 'Garble obfuscates Go code'
 stderr 'garble \[garble flags\] command'
 ! stdout .
 
-! garble help foo bar
+! exec garble help foo bar
 stderr 'usage: garble help'
 ! stderr 'Garble obfuscates Go code'
 ! stdout .
 
-! garble help -h
+! exec garble help -h
 stderr 'usage: garble help'
 ! stdout .
 
-! garble build -h
+! exec garble build -h
 stderr 'garble \[garble flags\] build'
 stderr 'This command wraps "go build"'
 stderr 'usage: go build'
@@ -31,7 +31,7 @@ stderr 'Run .go help build.'
 ! stderr 'Garble obfuscates Go code'
 ! stdout .
 
-! garble test -h
+! exec garble test -h
 stderr 'garble \[garble flags\] test'
 stderr 'This command wraps "go test"'
 stderr 'usage: go test'
@@ -39,49 +39,49 @@ stderr 'Run .go help test.'
 ! stderr 'Garble obfuscates Go code'
 ! stdout .
 
-! garble reverse -h
+! exec garble reverse -h
 stderr 'garble \[garble flags\] reverse \[build flags\] package \[files\]'
 ! stderr 'usage: go '
 ! stdout .
 
-! garble help reverse
+! exec garble help reverse
 stderr 'garble \[garble flags\] reverse \[build flags\] package \[files\]'
 ! stderr 'usage: go '
 ! stdout .
 
-! garble -badflag
+! exec garble -badflag
 stderr 'flag provided but not defined'
 stderr 'garble \[garble flags\] command'
 ! stdout .
 
-! garble badcmd
+! exec garble badcmd
 stderr 'unknown command'
 
-! garble build -badflag
+! exec garble build -badflag
 stderr 'usage: go build' # TODO: is this confusing?
 ! stdout .
 
-! garble build -tiny
+! exec garble build -tiny
 stderr 'must precede command, like: garble -tiny build \./pkg'
 ! stdout .
 
-! garble build -literals
+! exec garble build -literals
 stderr 'must precede command, like: garble -literals build \./pkg'
 ! stdout .
 
-! garble build -seed=random
+! exec garble build -seed=random
 stderr 'must precede command, like: garble -seed=random build \./pkg'
 ! stdout .
 
-[!windows] ! garble toolexec /does/not/exist/compile
-[windows] ! garble toolexec C:\does\not\exist\compile
+[!windows] ! exec garble toolexec /does/not/exist/compile
+[windows] ! exec garble toolexec C:\does\not\exist\compile
 stderr 'did you run.*instead of "garble \[command\]"'
 
-! garble build badpackage
+! exec garble build badpackage
 stderr 'package badpackage is not in GOROOT'
 ! stdout .
 
-! garble build ./badpackage
+! exec garble build ./badpackage
 stderr 'directory not found'
 ! stdout .
 
@@ -90,7 +90,7 @@ stderr 'directory not found'
 # To avoid building another garble binary,
 # and to be able to use static VCS info, use an environment variable.
 # First, test without the information, and then with it.
-garble version
+exec garble version
 stdout -count=1 'mvdan.cc/garble \(devel\)'
 stdout -count=1 'Build settings'
 stdout -count=3 '-compiler|GOOS|GOARCH'
@@ -98,7 +98,7 @@ stdout -count=3 '-compiler|GOOS|GOARCH'
 
 # Obtained from a real build while developing.
 env GARBLE_TEST_BUILDSETTINGS='[{"Key":"vcs","Value":"git"},{"Key":"vcs.revision","Value":"91ea246349544769f5100c29f79cb0f173abfeea"},{"Key":"vcs.time","Value":"2022-03-18T13:45:11Z"},{"Key":"vcs.modified","Value":"true"}]'
-garble version
+exec garble version
 stdout -count=1 'mvdan\.cc/garble v0\.0\.0-20220318134511-91ea24634954'
 stdout -count=1 'Build settings'
 stdout -count=3 '-compiler|GOOS|GOARCH'
@@ -107,10 +107,10 @@ stdout -count=1 'vcs\.revision 91ea246349544769f5100c29f79cb0f173abfeea'
 stdout -count=1 'vcs\.time 2022-03-18T13:45:11Z'
 stdout -count=1 'vcs\.modified true'
 
-! garble version -flag
+! exec garble version -flag
 stderr 'usage: garble version'
 
-! garble version arg
+! exec garble version arg
 stderr 'usage: garble version'
 
 # We need a dummy module for "garble build -badflag".
diff --git a/testdata/script/implement.txtar b/testdata/script/implement.txtar
index 9ed9752..c62c8a9 100644
--- a/testdata/script/implement.txtar
+++ b/testdata/script/implement.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 cmp stdout main.stdout
 
diff --git a/testdata/script/imports.txtar b/testdata/script/imports.txtar
index 616c942..956317f 100644
--- a/testdata/script/imports.txtar
+++ b/testdata/script/imports.txtar
@@ -14,7 +14,7 @@
 #    go clean -modcache && go get -d rsc.io/quote@v1.5.2 && go test -short
 env GOMODCACHE=$WORK/modcache
 
-garble build -tags buildtag
+exec garble build -tags buildtag
 exec ./main
 cmp stdout main.stdout
 
@@ -26,7 +26,7 @@ cmp stdout main.stdout
 # No packages should be rebuilt either, thanks to the build cache.
 cp main$exe main_old$exe
 rm main$exe
-garble build -tags buildtag -v
+exec garble build -tags buildtag -v
 ! stderr .
 bincmp main$exe main_old$exe
 
@@ -36,7 +36,7 @@ cmp stdout main.stdout
 
 # Check that -literals doesn't break anything.
 # Also check that a different form of -tags still works.
-garble -literals build --tags=buildtag
+exec garble -literals build --tags=buildtag
 exec ./main
 cmp stdout main.stdout
 -- go.mod --
diff --git a/testdata/script/init.txtar b/testdata/script/init.txtar
index 1cf31d2..ac1f51c 100644
--- a/testdata/script/init.txtar
+++ b/testdata/script/init.txtar
@@ -1,6 +1,6 @@
 # Test that garble keeps init functions in the order they were declared in.
 
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 
diff --git a/testdata/script/ldflags.txtar b/testdata/script/ldflags.txtar
index ed85d6a..d40b6d5 100644
--- a/testdata/script/ldflags.txtar
+++ b/testdata/script/ldflags.txtar
@@ -7,14 +7,14 @@
 #   -X "name=value" (or with single quotes, allows spaces in value)
 env LDFLAGS='-X=main.unexportedVersion=v1.22.33 -X=main.replacedWithEmpty= -X "main.replacedWithSpaces= foo bar " -X=domain.test/main/imported.ExportedUnset=garble_replaced -X=domain.test/missing/path.missingVar=value -X=main.someType=notAVariable'
 
-garble build -ldflags=${LDFLAGS}
+exec garble build -ldflags=${LDFLAGS}
 exec ./main
 cmp stdout main.stdout
 ! binsubstr main$exe 'domain.test/main' 'unexportedVersion' 'ExportedUnset'
 
 [short] stop # no need to verify this with -short
 
-garble -tiny -literals -seed=0002deadbeef build -ldflags=${LDFLAGS}
+exec garble -tiny -literals -seed=0002deadbeef build -ldflags=${LDFLAGS}
 exec ./main
 cmp stdout main.stdout
 ! binsubstr main$exe 'unexportedVersion' 'ExportedUnset'
diff --git a/testdata/script/linker.txtar b/testdata/script/linker.txtar
index 141be66..6be3e62 100644
--- a/testdata/script/linker.txtar
+++ b/testdata/script/linker.txtar
@@ -8,7 +8,7 @@
 # those commands are likely to fail as std and cmd are their own modules.
 env GOFLAGS=-modfile=${WORK}/go.mod
 
-garble build
+exec garble build
 exec ./main
 ! cmp stderr main.stderr
 
@@ -19,7 +19,7 @@ exec ./main
 # building the linker twice, wasting CPU and disk.
 [!windows] env GOOS=windows
 [windows] env GOOS=linux
-garble build
+exec garble build
 [!windows] [exec:git]   exists ${GARBLE_CACHE_DIR}/garble/link
 [!windows] [exec:git] ! exists ${GARBLE_CACHE_DIR}/garble/link.exe
 [windows]  [exec:git] ! exists ${GARBLE_CACHE_DIR}/garble/link
diff --git a/testdata/script/linkname.txtar b/testdata/script/linkname.txtar
index be03d92..a2ee29a 100644
--- a/testdata/script/linkname.txtar
+++ b/testdata/script/linkname.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 cmp stderr main.stderr
 
diff --git a/testdata/script/list_error.txtar b/testdata/script/list_error.txtar
index f7d20a5..bdc2697 100644
--- a/testdata/script/list_error.txtar
+++ b/testdata/script/list_error.txtar
@@ -1,4 +1,4 @@
-! garble build ./...
+! exec garble build ./...
 cmpenv stderr stderr.golden
 
 -- stderr.golden --
diff --git a/testdata/script/literals.txtar b/testdata/script/literals.txtar
index ff65467..c23a06e 100644
--- a/testdata/script/literals.txtar
+++ b/testdata/script/literals.txtar
@@ -1,4 +1,4 @@
-garble -literals build
+exec garble -literals build
 exec ./main$exe
 cmp stderr main.stderr
 
@@ -10,7 +10,7 @@ binsubstr main$exe 'skip typed const' 'skip typed var' 'skip typed var assign' '
 # Also check that the binary is reproducible.
 cp main$exe main_old$exe
 rm main$exe
-garble -literals build
+exec garble -literals build
 bincmp main$exe main_old$exe
 
 # Check that the program works as expected without garble.
@@ -30,7 +30,7 @@ go build
 binsubstr main$exe 'a_unique_string_that_is_part_of_all_extra_literals'
 
 # ensure we don't find the extra literals in an obfuscated build
-garble -literals -debugdir=debug1 build
+exec garble -literals -debugdir=debug1 build
 exec ./main$exe
 cmp stderr main.stderr
 ! binsubstr main$exe 'a_unique_string_that_is_part_of_all_extra_literals'
@@ -55,7 +55,7 @@ grep '^\s+type \w+ func\(byte\) \w+$' debug1/test/main/extra_literals.go
 
 # Finally, sanity check that we can build all of std with -literals.
 # Analogous to gogarble.txt.
-garble -literals build std
+exec garble -literals build std
 -- go.mod --
 module test/main
 
diff --git a/testdata/script/modinfo.txtar b/testdata/script/modinfo.txtar
index be3e8e5..c34d663 100644
--- a/testdata/script/modinfo.txtar
+++ b/testdata/script/modinfo.txtar
@@ -6,7 +6,7 @@
 [exec:git] exec git rev-parse HEAD
 [exec:git] setenvfile HEAD_COMMIT_SHA stdout
 
-garble build -tags veryuniquebuildtag
+exec garble build -tags veryuniquebuildtag
 ! binsubstr main$exe '(devel)' 'veryuniquebuildtag' ${HEAD_COMMIT_SHA}
 
 go version -m main$exe
diff --git a/testdata/script/plugin.txtar b/testdata/script/plugin.txtar
index 06d601b..0b29c40 100644
--- a/testdata/script/plugin.txtar
+++ b/testdata/script/plugin.txtar
@@ -2,7 +2,7 @@ skip # TODO: get plugins working properly. See issue #87
 
 [windows] skip 'Go plugins are not supported on Windows'
 
-garble build -buildmode=plugin ./plugin
+exec garble build -buildmode=plugin ./plugin
 binsubstr plugin.so 'PublicVar' 'PublicFunc'
 ! binsubstr plugin.so 'privateFunc'
 
@@ -16,7 +16,7 @@ binsubstr main$exe 'PublicVar' 'PublicFunc'
 
 # This used to fail, since in this case the package path for the ad-hoc plugin
 # package isn't "main", but "plugin/unnamed-*".
-garble build -buildmode=plugin plugin/main.go
+exec garble build -buildmode=plugin plugin/main.go
 
 go build -buildmode=plugin ./plugin
 binsubstr plugin.so 'PublicVar' 'PublicFunc' 'privateFunc'
diff --git a/testdata/script/position.txtar b/testdata/script/position.txtar
index a40a2b9..e02ca72 100644
--- a/testdata/script/position.txtar
+++ b/testdata/script/position.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 ! stdout 'garble_main\.go|garble_other_filename|is sorted'
 
diff --git a/testdata/script/reflect.txtar b/testdata/script/reflect.txtar
index 0f2552d..9af84b2 100644
--- a/testdata/script/reflect.txtar
+++ b/testdata/script/reflect.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main
 cmp stdout main.stdout
 
diff --git a/testdata/script/reverse.txtar b/testdata/script/reverse.txtar
index 2b83ccd..27e588c 100644
--- a/testdata/script/reverse.txtar
+++ b/testdata/script/reverse.txtar
@@ -1,8 +1,8 @@
 # Unknown build flags should result in errors.
-! garble reverse -badflag=foo .
+! exec garble reverse -badflag=foo .
 stderr 'flag provided but not defined'
 
-garble build
+exec garble build
 exec ./main
 cp stderr main.stderr
 
@@ -16,18 +16,18 @@ grep 'goroutine 1 \[running\]' main.stderr
 ! grep 'ExportedLib(Type|Field)|unexportedMainFunc|test/main|long_main\.go|long_lib\.go' main.stderr
 
 stdin main.stderr
-garble reverse .
+exec garble reverse .
 cmp stdout reverse.stdout
 
 # Ensure that we cleaned up the temporary files.
 # Note that we rely on the unix-like TMPDIR env var name.
 [!windows] ! grepfiles ${TMPDIR} 'garble|importcfg|cache\.gob|\.go'
 
-! garble build ./build-error
+! exec garble build ./build-error
 cp stderr build-error.stderr
 
 stdin build-error.stderr
-garble reverse ./build-error
+exec garble reverse ./build-error
 cmp stdout build-error-reverse.stdout
 
 [short] stop # no need to verify this with -short
@@ -38,17 +38,17 @@ exec ./main
 cmp stderr reverse.stdout
 
 # Ensure that we can still reverse with -literals.
-garble -literals build
+exec garble -literals build
 exec ./main
 cp stderr main-literals.stderr
 
 stdin main-literals.stderr
-garble -literals reverse .
+exec garble -literals reverse .
 cmp stdout reverse.stdout
 
 # Reversing a -literals output without the flag should fail.
 stdin main-literals.stderr
-! garble reverse .
+! exec garble reverse .
 cmp stdout main-literals.stderr
 -- go.mod --
 module test/main
diff --git a/testdata/script/run.txtar b/testdata/script/run.txtar
index c3772aa..74b8fe0 100644
--- a/testdata/script/run.txtar
+++ b/testdata/script/run.txtar
@@ -1,11 +1,11 @@
-garble run garble_main.go
+exec garble run garble_main.go
 ! stdout '^garble_main\.go 9$'
 stdout '\.go \d'
 
 [short] stop # no need to verify this with -short
 
 # also with a package
-garble run .
+exec garble run .
 ! stdout '^garble_main\.go 9$'
 stdout '\.go \d'
 
diff --git a/testdata/script/seed-cache.txtar b/testdata/script/seed-cache.txtar
index 45f6cfe..6164244 100644
--- a/testdata/script/seed-cache.txtar
+++ b/testdata/script/seed-cache.txtar
@@ -10,7 +10,7 @@ env SEED1=OQg9kACEECQ
 
 # First, ensure that mod1's garbletest.v2 is in the cache.
 cd mod1
-garble -seed=${SEED1} build gopkg.in/garbletest.v2
+exec garble -seed=${SEED1} build gopkg.in/garbletest.v2
 
 # We collect the Action IDs to ensure they're different.
 # This is one of the factors that confused garble.
@@ -20,7 +20,7 @@ cp stdout ../buildid-mod1
 # Then, do the mod2 build, using the different-but-equal garbletest.v2.
 # Ensure that our workaround's inserted garbleActionID does not end up in the binary.
 cd ../mod2
-garble -seed=${SEED1} build
+exec garble -seed=${SEED1} build
 ! binsubstr mod2$exe 'garbleActionID'
 
 go list -trimpath -export -f '{{.BuildID}}' gopkg.in/garbletest.v2
diff --git a/testdata/script/seed.txtar b/testdata/script/seed.txtar
index 0fd4b38..f461e20 100644
--- a/testdata/script/seed.txtar
+++ b/testdata/script/seed.txtar
@@ -9,7 +9,7 @@ env SEED1=OQg9kACEECQ
 env SEED2=NruiDmVz6/s
 
 # Check the binary with a given base64 encoded seed.
-garble -seed=${SEED1} build
+exec garble -seed=${SEED1} build
 exec ./main$exe
 cmp stderr main.stderr
 binsubstr main$exe 'teststring' 'imported var value'
@@ -24,7 +24,7 @@ cp stderr importedpkg-seed-static-1
 # No packages should be rebuilt either, thanks to the build cache.
 cp main$exe main_seed1$exe
 rm main$exe
-garble -seed=${SEED1}= build -v
+exec garble -seed=${SEED1}= build -v
 ! stderr .
 bincmp main$exe main_seed1$exe
 
@@ -42,11 +42,11 @@ cp stderr mainpkg-seed-static-1
 # TODO: also test that changing non-garble build parameters,
 # such as GOARCH or -tags, still results in the same hashing via the seed.
 
-garble -seed=${SEED1} -literals build
+exec garble -seed=${SEED1} -literals build
 exec ./main$exe test/main/imported
 cmp stderr importedpkg-seed-static-1
 
-garble -seed=${SEED1} -tiny build
+exec garble -seed=${SEED1} -tiny build
 exec ./main$exe test/main/imported
 cmp stderr importedpkg-seed-static-1
 
@@ -54,7 +54,7 @@ cmp stderr importedpkg-seed-static-1
 # We can't know if caching happens here, because of previous test runs.
 cp main$exe main_seed2$exe
 rm main$exe
-garble -seed=${SEED2} build
+exec garble -seed=${SEED2} build
 ! bincmp main$exe main_seed2$exe
 
 exec ./main$exe test/main/imported
@@ -62,7 +62,7 @@ cp stderr importedpkg-seed-static-2
 ! bincmp importedpkg-seed-static-2 importedpkg-seed-static-1
 
 # Use a random seed, which should always trigger a full build.
-garble -seed=random build -v
+exec garble -seed=random build -v
 stderr -count=1 '^-seed chosen at random: .+'
 stderr -count=1 '^runtime$'
 stderr -count=1 '^test/main$'
@@ -78,7 +78,7 @@ cp stderr importedpkg-seed-random-1
 # Also check that the random binary is not reproducible.
 cp main$exe main_random$exe
 rm main$exe
-garble -seed=random build -v
+exec garble -seed=random build -v
 stderr .
 ! bincmp main$exe main_random$exe
 
diff --git a/testdata/script/syntax.txtar b/testdata/script/syntax.txtar
index e13d87f..cfdaf8e 100644
--- a/testdata/script/syntax.txtar
+++ b/testdata/script/syntax.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 exec ./main$exe
 cmp stderr main.stderr
 
diff --git a/testdata/script/test.txtar b/testdata/script/test.txtar
index 7b5168a..f6edbfe 100644
--- a/testdata/script/test.txtar
+++ b/testdata/script/test.txtar
@@ -1,5 +1,5 @@
 # build the test binary
-garble test -c
+exec garble test -c
 ! stdout 'PASS'
 binsubstr bar.test$exe 'TestFoo' 'TestSeparateFoo'
 ! binsubstr bar.test$exe 'LocalFoo|ImportedVar|OriginalFuncName'
@@ -25,7 +25,7 @@ stdout 'package bar_test, func name:'
 #
 # The combination of those used to result in "refusing to list non-dependency
 # package" errors, which we've currently worked around.
-garble test -v ./...
+exec garble test -v ./...
 stdout 'ok\s+test/bar\s'
 stdout 'PASS.*TestFoo'
 stdout 'PASS.*TestMain'
@@ -40,7 +40,7 @@ stdout 'ok\s+test/bar/sometest\s'
 stdout 'ok\s+test/bar/exporttest\s'
 
 # verify that non-build flags are kept
-garble test -withflag -v
+exec garble test -withflag -v
 stdout 'PASS.*TestWithFlag'
 
 # verify with regular cmd/go; OriginalFuncName should appear
diff --git a/testdata/script/tiny.txtar b/testdata/script/tiny.txtar
index d78775c..015eb35 100644
--- a/testdata/script/tiny.txtar
+++ b/testdata/script/tiny.txtar
@@ -1,5 +1,5 @@
 # Tiny mode
-garble -tiny build
+exec garble -tiny build
 ! binsubstr main$exe 'garble_main.go' 'fmt/print.go'
 env GODEBUG='allocfreetrace=1,gcpacertrace=1,gctrace=1,inittrace=1,scavenge=1,scavtrace=1,scheddetail=1,schedtrace=10'
 ! exec ./main$exe
@@ -17,7 +17,7 @@ stderr 'funcStructExported false funcStructUnexported true'
 [short] stop # no need to verify this with -short
 
 # Default mode
-garble build
+exec garble build
 ! exec ./main$exe
 stderr '^caller: [0-9a-zA-Z_]+\.go [1-9]'
 stderr '^recovered: ya like jazz?'
diff --git a/testdata/script/typeparams.txtar b/testdata/script/typeparams.txtar
index 7b41341..d7728d4 100644
--- a/testdata/script/typeparams.txtar
+++ b/testdata/script/typeparams.txtar
@@ -1,4 +1,4 @@
-garble build
+exec garble build
 ! binsubstr main$exe ${WORK} 'garble_main.go' 'GenericFunc' 'GenericVector' 'PredeclaredSignedInteger' 'StringableSignedInteger' 'CombineEmbeds' 'GenericParam'
 -- go.mod --
 module test/main