`exported_private_dependencies` lint misses blanket implementations

Code

trait Priv {}
pub trait Pub {}

// Implementing private traits on types from private dependencies is allowed
impl Priv for priv_dep::S {}

// This implements a public trait for a struct from private dependency.
impl<T: Priv> Pub for T {}

Current output

No lint generated

Desired output

Either lint the impl or decide that this is ok.

Rationale and extra context

This can be used to add implementations that leak private dependencies. If we update the private dependency, the implementation may disappear (and implementation for the new version may appear).

I cannot come up with a reasonable use-case for anyone to do this though. The only thing that comes to mind is some kind of merge of sealed trait and extension trait. Or a public extension trait for types that implement a private trait.

So maybe we don't need to worry about that, and just ignore this. But I'd like to flag it anyway and get someone else's opinion on that.

I'm not sure how complex the implementation for linting this could get as we might have to do some orphan-rule-like checks on what a given blanked impl could cover. But I haven't given that much thought.

Other versions

Similar cases which should not lint as they're valid and used in production code from my experience:

Extension traits:

pub trait ServiceExt: Service { .. }

impl<S: Service> ServiceExt for S { .. }

As long as Service comes from a public dependency, this should be ok. Any updates of our private dependencies do not change what types (from private dependencies or otherwise) are or are not implemented.

Unrestricted blanket impl:

impl<T> Pub for T {}

should always be allowed. That case cannot break anything as all types have an implementation regardless of version (updating private dependency never adds or removes any implementations in that case).

Rust Version

master

Anything else?

Tracking issue for the lint #44663

@rustbot label +F-public_private_dependencies +L-exported_private_dependencies +A-lints +A-visibility

Changes to this lint are currently reviewed in #160726 but it doesn't change this.

Start with tracking issue #44663 and the lint changes currently reviewed in #160726. Compare the private-trait blanket implementation with the valid extension-trait and unrestricted blanket-impl examples, then determine whether the lint should cover this case. Done means an agreed behavior and corresponding lint changes, or a documented decision to allow it.