cmd/go: modules: exposure of internal packages

[urandom2]

What version of Go are you using (go version)?

$ go version
go version go1.12 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/user/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/user/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/user/pkg/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build962148623=/tmp/go-build -gno-record-gcc-switches"

What did you do?

/pkg
├── go.mod // module github.com/user/pkg
              replace golang.org/x/tools/notarealpackage => ./module
              require golang.org/x/tools/notarealpackage v0.0.0-00010101000000-000000000000
├── pkg.go // re-export pseudo module golang.org/x/tools/notarealpackage symbols
├── pkg_test.go // confirm re-export symbols work
└── module
    ├── go.mod // module golang.org/x/tools/notarealpackage
    └── module.go // export golang.org/x/tools/internal/module symbols

What did you expect to see?

[user@localhost pkg]$ go test
module/module.go:4:2: use of internal package golang.org/x/tools/internal/module not allowed
FAIL    github.com/user/pkg [setup failed]

this is the behaviour seen for the standard library:

module/module.go:4:2: use of internal package cmd/go/internal/semver not allowed

What did you see instead?

[user@localhost pkg]$ go test
PASS
ok      github.com/user/pkg      0.001s

[mvdan]

/cc @bcmills

[bcmills]

This appears to be working as designed: it's the same result as if you had injected golang.org/x/tools/notarealpackage in your GOPATH in GOPATH mode.

internal doesn't prevent other packages from accessing your code. They could always do that anyway: they're executing arbitrary code within your address space, after all.

What internal does do is set up some social conventions around API stability, and prompt you to make an explicit decision when you're about to violate those conventions.

(Also note that, because outside users of your module will not follow your module's replace directives, this trick will not work within modules used as dependencies of other modules.)