bug#17418: #:select gives access to private variables

[Mark H Weaver <mhw@netris.org>]

ludo@gnu.org (Ludovic Courtès) writes:

> Consider this module:
>
> (define-module (t))
>
> (define private #t)
>
> And now:
>
> [ludo@pluto:~/src/guix]$ guile -L .
> GNU Guile 2.0.11.20-4338f
> Copyright (C) 1995-2014 Free Software Foundation, Inc.
>
> Guile comes with ABSOLUTELY NO WARRANTY; for details type `,show w'.
> This program is free software, and you are welcome to redistribute it
> under certain conditions; type `,show c' for details.
>
> Enter `,help' for help.
> scheme@(guile-user)> (use-modules (t))
> ;;; note: source file ./t.scm
> ;;;       newer than compiled /home/ludo/.cache/guile/ccache/2.0-LE-8-2.0/home/ludo/src/guix/t.scm.go
> ;;; note: auto-compilation is enabled, set GUILE_AUTO_COMPILE=0
> ;;;       or pass the --no-auto-compile argument to disable.
> ;;; compiling ./t.scm
> ;;; compiled /home/ludo/.cache/guile/ccache/2.0-LE-8-2.0/home/ludo/src/guix/t.scm.go
> scheme@(guile-user)> private
> ;;; <unknown-location>: warning: possibly unbound variable `private'
> ERROR: In procedure #<procedure 1e532a0 ()>:
> ERROR: In procedure module-lookup: Unbound variable: private
>
> Entering a new prompt.  Type `,bt' for a backtrace or `,q' to continue.
> scheme@(guile-user) [1]> 
>
> This is as expected.
> But adding #:select (private) gives access to ‘private’:
>
> [ludo@pluto:~/src/guix]$ guile -L .
> GNU Guile 2.0.11.20-4338f
> Copyright (C) 1995-2014 Free Software Foundation, Inc.
>
> Guile comes with ABSOLUTELY NO WARRANTY; for details type `,show w'.
> This program is free software, and you are welcome to redistribute it
> under certain conditions; type `,show c' for details.
>
> Enter `,help' for help.
> scheme@(guile-user)> (use-modules ((t) #:select (private)))
> scheme@(guile-user)> private
> $1 = #t

I agree that this is arguably a bug, but there exists code that depends
on this behavior.  One example is system/repl/coop-server.scm, which
needs access to some private bindings from system/repl/server.scm and
system/repl/repl.scm.  I confess that I even suggested it, because the
alternatives were unpleasant.

Perhaps we should consider making #:select issue a warning when it
imports private bindings, and also adding a mechanism to import private
bindings without a warning.

What do you think?

    Mark