Tracking issue for RFC 1977: public & private dependencies

[withoutboats]

Summary

RFC (original, superseded): #1977
RFC: #3516
Cargo tracking issue: rust-lang/cargo#6129
Issues: https://github.com/rust-lang/rust/issues?q=is%3Aissue+is%3Aopen+label%3AF-public_private_dependencies
Cargo issues: https://github.com/rust-lang/cargo/issues?q=is%3Aopen+is%3Aissue+label%3AZ-public-dependency
Documentation: https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#public-dependency

This feature enables the ability to track which dependencies are publicly exposed through a library's interface. It has two sides to the implementation: rustc (lint and --extern flag), and cargo (Cargo.toml syntax, and passing --extern flags).

This feature was originally specified in rust-lang/rfcs#1977, but was later down-scoped in rust-lang/rfcs#3516.

About tracking issues

Tracking issues are used to record the overall progress of implementation.
They are also used as hubs connecting to other relevant issues, e.g., bugs or open design questions.
A tracking issue is however not meant for large scale discussion, questions, or bug reports about a feature.
Instead, open a dedicated issue for the specific matter and add the relevant feature gate label.
Discussion comments will get marked as off-topic or deleted.
Repeated discussions on the tracking issue may lead to the tracking issue getting locked.

Unresolved Questions

Steps

• Implementation
  • Implement public/private dependency feature #57586
  • Properly parse '--extern-private' with name and path #59335
  • Add options to --extern flag. #67074
  • Lint exported_private_dependencies misses public dependency via trait impl #71043
  • exported_private_dependencies lint only take effect in innermost dependency #119428
  • Add some tests for public-private dependencies. #122665
  • Fixed the private-dependency bug #122757
  • part of the infrastructure for public & private dependencies in the resolver cargo#6653
  • Implement the 'frontend' of public-private dependencies cargo#6772
  • add public & private prop tests. cargo#6962
  • Support public dependency configuration with workspace deps cargo#12817
  • Limit exported-private-dependencies lints to libraries cargo#13039
  • fix(resolver): Remove unused public-deps error handling cargo#13036
  • Add --public support for cargo add cargo#13037
  • cargo add should check public transitive dependencies when auto-picking a version cargo#13038
  • Switch public/private dependencies to a non-blocking feature gate cargo#13308
  • Include public/private dependency status in cargo metadata cargo#14502
  • Command to update Cargo.lock to minimal versions (Command to update Cargo.lock to minimal versions cargo#4100)
  • Make cargo publish use the minimal versions allowed by Cargo.toml
  • Ensure quality of error messages is sufficient
  • cargo fix support for exported-private-dependencies cargo#13095
  • Make exported-private-dependencies allow-by-default pre-2024 and deny-by-default in 2024+ / in the 2024-compatibility lint group
    • Perform a crater run and evaluate whether the pre-202x edition lint should be allow or warn (context from zulip)
• Implement migration lints.
• Add documentation to the edition guide.
• Ensure ready for Rust 2024 stabilization.
• How do we handle unifying public between more than one dependencies table (normal, target A normal, target B normal), both public = <bool> and default and public = true with public = false

Non-blocking further improvements

• Add Cargo.toml context to exported-private-dependencies lints cargo#13096

Changes from RFC

• RFC did not specify workspace inheritance behavior. With fix(toml): Disallow inheriting of dependency public status  cargo#13125, we disallow it.

cc @rust-lang/cargo @epage

[Boscop]

Maybe it's useful to look at how this problem is approached in Haskell.
Here are some relevant slides: https://wiki.haskell.org/wikiupload/b/b4/HIW2011-Talk-Loeh.pdf

Here is an example of a subtle issue that occurs with private dependencies:

Btw, I found it through this post: http://harry.garrood.me/blog/purescript-why-bower/

[Eh2406]

Would Rust2018 be a good opportunity to make the braking changes to Cargo.toml?

[SimonSapin]

Maybe. Though such changes should be designed and proposed soon, have an easy migration path, and preferably only affect a minority of existing crates.