CMake target_link_libraries Interface Dependencies

Question

If you are creating a shared library and your source cpp files #include the headers of another library (Say, QtNetwork for example), but your header files don't include QtNetwork headers, then QtNetwork is a PRIVATE dependency.

If your source files and your headers include the headers of another library, then it is a PUBLIC dependency.

If your header files other than your source files include the headers of another library, then it is an INTERFACE dependency.

Other build properties of PUBLIC and INTERFACE dependencies are propagated to consuming libraries. http://www.cmake.org/cmake/help/v3.0/manual/cmake-buildsystem.7.html#transitive-usage-requirements

@steveire accepted answer is great. I just wanted to add a table to quickly see the difference:

.-----------.------------------.----------------.
|           | Linked by target | Link interface |
:-----------+------------------+----------------:
| PUBLIC    |        X         |        X       |
:-----------+------------------+----------------:
| PRIVATE   |        X         |                |
:-----------+------------------+----------------:
| INTERFACE |                  |        X       |
'-----------'------------------'----------------'

• Linked by target: libraries included in target sources (not a dependency for projects linking the library).
• Link interface: libraries included in target public headers (dependencies for projects linking the library).

Not my brainchild but this extremely useful explanation helped me understand the situation. The most important part is quoted below for reference:

• When A links B as PRIVATE, it is saying that A uses B in its implementation, but B is not used in any part of A's public API. Any code that makes calls into A would not need to refer directly to anything from B. An example of this could be a networking library A which can be built to use one of a number of different SSL libraries internally (which B represents). A presents a unified interface for client code which does not reference any of the internal SSL data structures or functions. Client code would have no idea what SSL implementation (B) is being used by A, nor does
  that client code need to care.
• When A links B as INTERFACE, it is saying that A does not use B in its implementation, but B is used in A's public API. Code that calls into A may need to refer to things from B in order to make such calls. One example of this is an interface library which simply forwards calls along to another library but doesn't actually reference the objects on the way through other than by a pointer or reference. Another example is where A is defined in CMake as an interface library, meaning it has no actual implementation itself, it is effectively just a collection of other libraries (I'm probably over-simplifying here, but you get the picture).
• When A links B as PUBLIC, it is essentially a combination of PRIVATE and INTERFACE. It says that A uses B in its implementation and B is also used in A's public API.

Consider first what this means for include search paths. If something links against A, it will also need any include search paths from B if B is in A's public API. Thus, if A links B either as PUBLIC or INTERFACE, then any header search paths defined for target B will also apply to anything that links to A. Any PRIVATE header search path for B will NOT be carried through to anything that links only to A. The target_include_directories() command handles this. The situation with compile flags is analogously handled with target_compile_definitions() and target_compile_options().

Now consider the situation for the actual libraries involved. If A is a shared library, then A will have encoded into it a dependency on B. This information can be inspected with tools like ldd on Linux, otool on Mac and something like Dependency Walker (a.k.a. depends.exe) on Windows. If other code links directly to A, then it also will have encoded into it a dependency on A. It will not, however, have a dependency on B unless A links B either as PUBLIC or INTERFACE. So far, so good. If, however, A is a static library, the situation changes. Static libraries do not carry information about other libraries they depend on. For this reason, when A links B as PRIVATE and another target C links A, CMake will still add B to the list of libraries to be linked for C because parts of B are needed by A, but A itself doesn't have that dependency encoded into it. So even though B is an internal implementation detail of A, C still needs B added to the linker command, which CMake conveniently handles for you.

If you were paying careful attention, you would have noticed that when A links B as PRIVATE, the include directories of B never propagate to something linking to A, but if A is a static library, then the linking of B behaves as though the relationship was PUBLIC. This PRIVATE-becomes-PUBLIC behaviour for static libraries only applies to the linking, not to the other dependencies (compiler options/flags and include search paths). The upshot of all this is that if you select PRIVATE, PUBLIC or INTERFACE based on the explanations in the dot points above, then CMake will ensure dependencies propagate through to where they are required, regardless of whether libraries are static or shared. This does, of course, rely on you the developer not missing any dependencies or specifying the wrong PRIVATE/PUBLIC/INTERFACE relationship.