language semantics: Go doesn't enforce private types when using type deduction with := operator

[tnozicka]

What version of Go are you using (go version)?

$ go version
go version go1.20.1 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/var/home/dev/.cache/go-build"
GOENV="/var/home/dev/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/dev/dev/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/dev/dev/go"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/var/home/dev/dev/lib/golang/go1.20.1.src/go"
GOSUMDB="off"
GOTMPDIR=""
GOTOOLDIR="/var/home/dev/dev/lib/golang/go1.20.1.src/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="0"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3891585286=/tmp/go-build -gno-record-gcc-switches"

What did you do?

package main

// Using private type works with type deduction (IMO it shouldn't have).
v := lib.Foo()

// Explicitly using the same type would fail to compile.
// var v lib.myType = lib.Foo()

Playground examples:
var v lib.myType = lib.Foo() - https://go.dev/play/p/YG1mv5bZCp2

./prog.go:14:12: myType not exported by package lib
./prog.go:14:21: cannot use lib.Foo() (value of type *lib.myType) as lib.myType value in variable declaration

v := lib.Foo() - https://go.dev/play/p/_XOR5LCDKUc

Result: &lib.myType{}

What did you expect to see?

Using private types should have failed with type deduction the same ways it does for explicit declarations of the same type.

What did you see instead?

Private types are enforced only with explicit declarations but are not enforced for deducted variable types.

[zigo101]

Go has no "public type" and "private type" concepts.
Go only has "exported identifier" and "unexported identifier" concpets.
An unexported identifier can't be used (in code) outside of its containing package, but the type denoted by the unexported identifier may be used (in logic) outside of its containing package, because the type may have exported alias names.

[ianlancetaylor]

As @go101 says: unexported is about identifiers, not types. This is not a bug, and it's not something we can or will change today. Thanks.

[zephyrtronium]

See also #56669.