Another attempt to implementation_deps, preserving transitivity

The observation is that :ssl needs to say two things:

1. ssl_headers depends on crypto_headers
2. ssl_sources depends on crypto_internal_headers

The first impacts :ssl's dependents, so it should act like deps. The
second is private to :ssl, so it should act like implementation_deps.
Specify both.

Change-Id: Ie92b6d619d22f61dca870b02ffe12d4370c8947c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/85029
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

BUILD.bazel

diff --git a/BUILD.bazel b/BUILD.bazel
index c8c4b16..927c6ae 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -89,7 +89,10 @@
     copts = ["-DBORINGSSL_IMPLEMENTATION"],
     internal_hdrs = ssl_internal_headers,
     visibility = ["//visibility:public"],
-    deps = [":crypto_internal"],
+    # ssl_headers depend on :crypto's exported headers.
+    deps = [":crypto"],
+    # ssl_sources also depend on :crypto's internal headers.
+    implementation_deps = [":crypto_internal"],
 )
 
 bssl_cc_library(

util/util.bzl

diff --git a/util/util.bzl b/util/util.bzl
index 6b5b750..ff8574d 100644
--- a/util/util.bzl
+++ b/util/util.bzl
@@ -132,6 +132,7 @@
         asm_srcs = [],
         copts = [],
         deps = [],
+        implementation_deps = [],
         hdrs = [],
         includes = [],
         internal_hdrs = [],
@@ -159,6 +160,7 @@
         includes = includes,
         linkopts = linkopts,
         deps = deps,
+        implementation_deps = implementation_deps,
         testonly = testonly,
         alwayslink = alwayslink,
         **linkstatic_kwargs(linkstatic)
@@ -168,7 +170,13 @@
         cc_library(
             name = name,
             hdrs = hdrs,
-            deps = [":" + name_internal],
+            # Depend on the internal target via implementation_deps to avoid
+            # re-exporting internal_hdrs.
+            implementation_deps = [":" + name_internal],
+            # Although picked up transitively, re-specify deps and includes, so
+            # that targets depending on the public target also pick them up.
+            deps = deps,
+            includes = includes,
             visibility = visibility,
         )