From 8b842dde3ce3af1a2112b695c54eadeecbb9dfa8 Mon Sep 17 00:00:00 2001
From: "Chris (ChrisJr404)" <11917633+ChrisJr404@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:06:14 -0400
Subject: [PATCH] add install to wrap "go install"

garble already wraps build, test and run through the same toolexec setup,
and install builds packages the same way, so it slots into that path with
no special handling. It saves obfuscating a binary with garble build and
then moving it into GOBIN by hand.

Fixes #981.
---
 AUTHORS                       |  1 +
 README.md                     |  1 +
 main.go                       |  3 ++-
 testdata/script/help.txtar    |  8 ++++++++
 testdata/script/install.txtar | 30 ++++++++++++++++++++++++++++++
 5 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 testdata/script/install.txtar

diff --git a/AUTHORS b/AUTHORS
index 3b921d8f..47ce3e8c 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -7,6 +7,7 @@
 # Please keep the list sorted.
 
 Andrew LeFevre <jalefevre@liberty.edu>
+Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com>
 Daniel Martí <mvdan@mvdan.cc>
 Emmanuel Chee-zaram Okeke <ecokeke21@gmail.com>
 Golo Roden <golo.roden@thenativeweb.io>
diff --git a/README.md b/README.md
index 31d48a4f..46a970de 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,7 @@ Obfuscate Go code by wrapping the Go toolchain. Requires Go 1.27 or later.
 
 The tool also supports `garble test` to run tests with obfuscated code,
 `garble run` to obfuscate and execute simple programs,
+`garble install` to build and install obfuscated binaries,
 `garble reverse` to de-obfuscate text such as stack traces,
 and `garble bug` to file a pre-filled bug report.
 Run `garble -h` to see all available commands and flags.
diff --git a/main.go b/main.go
index 51d2ae18..ab6a3f39 100644
--- a/main.go
+++ b/main.go
@@ -241,7 +241,7 @@ func mainErr(args []string) error {
 		return commandMap(args)
 	case "bug":
 		return commandBug(args)
-	case "build", "test", "run":
+	case "build", "test", "run", "install":
 		cmd, err := toolexecCmd(command, args)
 		defer func() {
 			if err := os.RemoveAll(os.Getenv("GARBLE_SHARED")); err != nil {
@@ -666,6 +666,7 @@ The following commands are supported:
 	build          replace "go build"
 	test           replace "go test"
 	run            replace "go run"
+	install        replace "go install"
 	reverse        de-obfuscate output such as stack traces
 	map            describe how names are obfuscated, as JSON
 	bug            start a bug report
diff --git a/testdata/script/help.txtar b/testdata/script/help.txtar
index 8e4eb39a..571d6b4c 100644
--- a/testdata/script/help.txtar
+++ b/testdata/script/help.txtar
@@ -39,6 +39,14 @@ stderr 'Run .go help test.'
 ! stderr 'Garble obfuscates Go code'
 ! stdout .
 
+! exec garble install -h
+stderr 'garble \[garble flags\] install'
+stderr 'This command wraps "go install"'
+stderr 'usage: go install'
+stderr 'Run .go help install.'
+! stderr 'Garble obfuscates Go code'
+! stdout .
+
 ! exec garble reverse -h
 stderr 'garble \[garble flags\] reverse \[build flags\] package \[files\]'
 ! stderr 'usage: go '
diff --git a/testdata/script/install.txtar b/testdata/script/install.txtar
new file mode 100644
index 00000000..7bbd92e9
--- /dev/null
+++ b/testdata/script/install.txtar
@@ -0,0 +1,30 @@
+# Check that "garble install" builds and installs an obfuscated binary.
+env GOBIN=$WORK/bin
+exec garble install .
+exists $WORK/bin/main$exe
+
+# The installed binary works and is obfuscated.
+exec $WORK/bin/main$exe
+stdout '^hello from garble install$'
+! binsubstr $WORK/bin/main$exe ${WORK} 'garble_main.go' 'greeting' 'test/main'
+
+[short] stop # installing a second time to check caching is slow
+
+# Installing again reuses the build cache and produces the same binary.
+cp $WORK/bin/main$exe $WORK/bin/main_old$exe
+rm $WORK/bin/main$exe
+exec garble install .
+bincmp $WORK/bin/main$exe $WORK/bin/main_old$exe
+
+-- go.mod --
+module test/main
+
+go 1.23
+-- garble_main.go --
+package main
+
+import "fmt"
+
+func greeting() string { return "hello from garble install" }
+
+func main() { fmt.Println(greeting()) }