Update gcloud to 576.0.0 (#434)

* Update gcloud to 576.0.0

* gcloud: assert the bundle LICENSE is still Apache at build time (inbox#284)

Resolves the #284 gcloud verify item: the bundle's own LICENSE declares
Apache-2.0 for the CLI and its source; the ToS language in it governs use of
GCP services, not redistribution of the CLI - so public-cache redistribution
is fine. Tom's suggestion: guard that conclusion at build time - if Google
ever ships the bundle under different terms, the build fails loudly and the
redistribution question gets re-audited rather than silently shipping.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 720de05)

* gcloud: fix LICENSE assert (match Apache-2.0 URL, not the wrapped phrase)

The bundle LICENSE wraps "...licensed under Apache\nLicense v. 2.0", so
`grep "Apache License"` never matched and the assert failed on a genuinely
Apache-licensed bundle. Match the canonical single-line Apache-2.0 URL instead.
Build-verified: gcloud builds green with the assert passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: gominimal-pkgmgr-mgr[bot] <285843623+gominimal-pkgmgr-mgr[bot]@users.noreply.github.com>
Co-authored-by: bryan <bryan@minimal.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

packages/gcloud/build.ncl

@@ -5,7 +5,7 @@ let python = import "../python/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 let sqlite = import "../sqlite/build.ncl" in
 
-let version = "568.0.0" in
+let version = "576.0.0" in
 # Google's per-version GCS bucket; explicit per-version path. The
 # previous rapid-channel URL
 # (dl.google.com/dl/cloudsdk/channels/rapid/downloads) has the
@@ -16,8 +16,8 @@ let version = "568.0.0" in
 let dl_base = "https://storage.googleapis.com/cloud-sdk-release" in
 
 let { amd64_sha256, arm64_sha256 } = {
-  amd64_sha256 = "ee39a260f5d30486c654be018b0e99f396a9c061617d206becaca4456e84ff94",
-  arm64_sha256 = "0b31153517665f12a664675b48571938f0beeec46450485e966a4dce7b125cf6",
+  amd64_sha256 = "7094a08e8fc3772cdbfb1a8a1920300f52fec5e370c9f9c803c2a3c8824a32c2",
+  arm64_sha256 = "be6077ade7b08312a250b49b5838473253c52e25358c63cfb2cfb4095503b5f2",
 }
 in
 

packages/gcloud/build.sh

@@ -9,6 +9,21 @@ esac
 
 tar -xof "google-cloud-cli-${MINIMAL_ARG_VERSION}-linux-${PLATFORM}.tar.gz"
 
+# Redistribution guard (gominimal/inbox#284): serving this bundle from the
+# public cache is fine because the bundle's own LICENSE is Apache-2.0 — its
+# ToS clauses govern *use of GCP services*, not redistribution of the CLI.
+# If Google ever changes the bundle license, fail loudly so the
+# redistribution question gets re-audited instead of silently shipping.
+# Match the Apache-2.0 URL, NOT the phrase "Apache License": the bundle's LICENSE
+# wraps it as "...licensed under Apache\nLicense v. 2.0", so a single-line grep for
+# "Apache License" never matches (that was the assert's original bug — it failed
+# on a genuinely Apache-licensed bundle). The URL sits on one line and is the
+# canonical Apache-2.0 marker.
+grep -q "apache.org/licenses/LICENSE-2.0" google-cloud-sdk/LICENSE || {
+  echo "gcloud bundle LICENSE no longer points at the Apache-2.0 license — re-audit redistribution (gominimal/inbox#284)" >&2
+  exit 1
+}
+
 mkdir -p $OUTPUT_DIR/usr/{bin,lib}
 mv google-cloud-sdk $OUTPUT_DIR/usr/lib/google-cloud-sdk