complain when GOPRIVATE matches no packages

This is important, because it would mean that we would obfuscate
nothing. At best, it would be confusing; at worst, it could mislead
the user into thinking the binary is obfuscated.

Fixes #20.
Updates #108.

main.go

@@ -318,6 +318,16 @@ func mainErr(args []string) error {
 		if err := f.Close(); err != nil {
 			return err
 		}
+		anyPrivate := false
+		for path := range listedPackages {
+			if isPrivate(path) {
+				anyPrivate = true
+				break
+			}
+		}
+		if !anyPrivate {
+			return fmt.Errorf("GOPRIVATE %q does not match any packages to be built", envGoPrivate)
+		}
 
 		execPath, err := os.Executable()
 		if err != nil {
@@ -564,18 +574,18 @@ func transformCompile(args []string) ([]string, error) {
 	return append(flags, newPaths...), nil
 }
 
-// isPrivate checks if GOPRIVATE matches pkgPath.
+// isPrivate checks if GOPRIVATE matches path.
 //
 // To allow using garble without GOPRIVATE for standalone main packages, it will
 // default to not matching standard library packages.
-func isPrivate(pkgPath string) bool {
-	if pkgPath == "main" || strings.HasPrefix(pkgPath, "plugin/unnamed") {
+func isPrivate(path string) bool {
+	if path == "main" || path == "command-line-arguments" || strings.HasPrefix(path, "plugin/unnamed") {
 		// TODO: why don't we see the full package path for main
 		// packages? The linker has it at the top of -importcfg, but not
 		// the compiler.
 		return true
 	}
-	return GlobsMatchPath(envGoPrivate, pkgPath)
+	return GlobsMatchPath(envGoPrivate, path)
 }
 
 func readBuildIDs(flags []string) error {

testdata/scripts/goprivate.txt

@@ -0,0 +1,16 @@
+env GOPRIVATE=match-absolutely/nothing
+! garble build -o bin ./standalone
+stderr 'does not match any packages'
+
+[short] stop
+
+# TODO: https://github.com/mvdan/garble/issues/108
+# env GOPRIVATE='*'
+# garble build  -o bin ./standalone
+
+-- go.mod --
+module test/main
+-- standalone/main.go --
+package main
+
+func main() {}