CMake PUBLIC, PRIVATE and INTERFACE: repairing dependency scope without global flags

What it is

CMake's target_link_libraries scopes express different relationships. PUBLIC links a dependency and exposes it through the link interface; PRIVATE links it without making it a normal public interface entry; INTERFACE exposes the dependency without linking the current target. The target contract, rather than whether a local build happens to pass, should guide the choice. CMake target_link_libraries

Why it matters

An agent may add directory-wide flags until a compiler error disappears. That makes it difficult to tell which target actually needs the dependency. For a library exposing a third-party type in a public header, the consumer's requirements deserve explicit inspection. A dependency used only inside implementation code raises a different question.

How to apply

• Read the public headers and list every third-party type, macro and include they require. Separately list implementation-only dependencies.
• Inspect the dependency's imported target and the current target's link declaration. Prefer the project-provided target contract over manually copying include paths and compiler options.
• Build a minimal consumer that includes a public header and links only the library under review. Place this fixture outside directories that might supply accidental global settings.
• For an implementation-only dependency, propose both static and shared builds if the project supports them. Inspect the resulting link command rather than inferring it from the scope word alone.
• Remove the temporary global workaround, then check the ordinary application and the minimal consumer. Keep the dependency rationale next to the target declaration.

Pitfalls

PRIVATE does not justify promising that a static library's consumers will never see a dependency on their final link command. Static linking has additional transitive requirements. Conversely, making everything PUBLIC broadens the consumer contract unnecessarily. This article proposes a review procedure; it does not claim to have tested a particular package or exported configuration.