cmd/go: Contents of internal package can be exposed through non-internal package

[codesoap]

Go version

go version go1.23.1 openbsd/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/richard/.cache/go-build'
GOENV='/home/richard/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='openbsd'
GOINSECURE=''
GOMODCACHE='/home/richard/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='openbsd'
GOPATH='/home/richard/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/openbsd_amd64'
GOVCS=''
GOVERSION='go1.23.1'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/richard/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='cc'
CXX='c++'
CGO_ENABLED='1'
GOMOD='/tmp/gotest/baz/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2555655373=/tmp/go-build -gno-record-gcc-switches'

What did you do?

I created a Go module with a non-internal package foo and an internal package foo/internal/bar with the following contents:

$ cat foo/internal/bar/bar.go
package bar

type Bar struct {
        X int
}

$ cat foo/foo.go
package foo

import "foo/internal/bar"

func Foo() bar.Bar {
        return bar.Bar{X: 42}
}

What did you see happen?

In another Go module, I was able to use the return value of the Foo function with the following code:

$ cat baz/baz.go
package main

import "fmt"
import "foo"

func main() {
        fmt.Println(foo.Foo().X)
}

$ cd baz && go run .
42

What did you expect to see?

I expected the compiler to stop me from exposing the internal struct Bar through the non-internal function Foo.

[gabyhelp]

Related Issues

• External access to Internal package in workspace #71218 (closed)
• cmd/go: modules: exposure of internal packages #30569 (closed)
• cmd/go: internal package is importable to the packages which is not rooted in the same subtree. #12217 (closed)
• cmd/go: can't use internal package in a module #27022 (closed)
• x/tools/cmd/goimports: does not consider "internal" restrictions #15993 (closed)
• cmd/go/internal/modload: `MainModuleSet.DirImportPath` does not check module boundaries #66119
• cmd/go: document 'internal' package visibility for module mode #38579

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

that's working as intended