google-cloud-cli 592.0.0-1
A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
config.json file.
/v1/packages/google-cloud-cli/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Optional dependencies
Conflicts
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| 48339fe4c8e3head | verified | 2026-11-05 16:11 | 6 |
| cc2248a3116a | verified | 2026-11-05 16:10 | 6 |
| e84f4793a905 | verified | 2026-11-05 16:10 | 6 |
| 253e09a19fcc | verified | 2026-11-05 16:04 | 6 |
| f2bbb614a811 | verified | 2026-11-05 16:03 | 6 |
Head findings
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cat <<<"$(jq '.disable_updater = false' <lib/googlecloudsdk/core/config.json)" >lib/googlecloudsdk/core/config.json
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cat <<<"$(jq '.disable_updater = true' <lib/googlecloudsdk/core/config.json)" >lib/googlecloudsdk/core/config.json
command-substitution
in
google-cloud-cli.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
ALL_OFF="$(tput sgr0)"
command-substitution
in
google-cloud-cli.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
BOLD="$(tput bold)"
command-substitution
in
google-cloud-cli.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
BLUE="${BOLD}$(tput setaf 4)"command-substitution
in
google-cloud-cli.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
YELLOW="${BOLD}$(tput setaf 3)"Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.