Consider this package:

(use-modules
  (guix packages)
  (guix build-system trivial)
  (gnu packages version-control))

(define foo
  (package
    (name "foo")
    (version "0")
    (source #f)
    (build-system trivial-build-system)
    (arguments
     `(#:builder
       (begin
         (display %build-inputs)
         #t)))
    (inputs
     `(("libgit2" ,libgit2)))
    (synopsis "")
    (description "")
    (home-page "")
    (license #f)))

When we try building it, it prints:

((libgit2 . /gnu/store/hlcfmg5n29ynf354x7s4s7bkxswrmkq4-libgit2-1.0.1) (zlib . /gnu/store/rykm237xkmq7rl1p0nwass01p090p88x-zlib-1.2.11) (pcre2 . /gnu/store/ckpchpflfwhag5qsfk8klvmihwzqg9rp-pcre2-10.35) (openssl . /gnu/store/dkzivzn17qilmqdfpyps62b395wxhshh-openssl-1.1.1f))

Why? I would expect only libgit2 to be present, and not all of its
dependencies. It seems to me that this has only downsides - the entire
transitive closure needs to be present during build, even when the
actually used dependencies don't reference it, and the names of inputs
used by packages are now public API, and changing them can break the
build of any transitively dependent package.

I've traced this back to bag->derivation's use of
bag-transitive-inputs, but unfortunately git blame didn't hold any hints
- it has been this way ever since bag->derivation was first implemented.

Am I missing something, or is this a bug?

Regards,
Jakub Kądziołka