Linker exposing private symbols

[Jeffrey Walton <noloader at gmail dot com>]

I'm trying to understand some behavior I am seeing when linking a
wrapper shared object to an archive. The archive is a C++ library and
has hundreds of members and thousands (maybe 10's of thousands) of
functions. The wrapper shared object exports 2 symbols using GCC
attributes.

With symbol visibility and without --exclude-libs:

$ g++ -o sha256_wrapper.so -g2 -O3 -shared -fPIC -ffunction-sections
-fdata-sections -fvisibility=hidden -fvisibility-inlines-hidden
sha256_wrapper.o ./libcryptopp.a -Wl,--gc-sections

Results in:

$ nm -gCD sha256_wrapper.so | grep ' T ' | wc -l
816

With symbol visibility and with --exclude-libs,All:

$ g++ -o sha256_wrapper.so -DNDEBUG -g2 -O3 -shared -fPIC
-ffunction-sections -fdata-sections -fvisibility=hidden
-fvisibility-inlines-hidden sha256_wrapper.o ./libcryptopp.a
-Wl,--gc-sections -Wl,--exclude-libs,All

$ nm -gCD sha256_wrapper.so | grep ' T ' | wc -l
816

With symbol visibility and with --exclude-libs,ALL:

$ nm -gCD sha256_wrapper.so | grep ' T '
00000000000184e8 T _fini
00000000000069d0 T _init
00000000000095b0 T sha256_hash_message
0000000000009710 T sha256_verify_digest

The last one is the one I expect from all of them because we are using
symbol visibility.

I'm on Fedora 28 and GCC version is 8.1.1 and LD version is 2.29.1.

I have two questions. First, why doesn't the toolchain honor the
visibility request (why do I need --exclude-libs)? I uess another way
to put it is, how can symbols be re-exported if they are private?
Second, why is ALL case sensitive (and without a diagnostic)?

Jeff