Google Cloud CLI¶

ID: gcloud
Home page: https://cloud.google.com/sdk/gcloud
Version requirement: >= 170
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · outdated · install · upgrade_all · remove
purl types: pkg:gcloud
CLI name: gcloud
Issues and PRs: 📦 manager: gcloud
Source: meta_package_manager/managers/gcloud.toml

gcloud is Google’s Cloud CLI (https://cloud.google.com/sdk/gcloud), and the part of it wrapped here is gcloud components, which installs and updates the SDK’s own components. Everything else gcloud does manages cloud resources rather than packages, and is out of scope.

A package is a component, identified by its id: bq, gsutil, kubectl, app-engine-python, beta. The name field alongside it is a human display string (“BigQuery Command Line Tool”) and is not an identifier.

Note

The listing renders as a bordered table by default, which is only a default: gcloud’s --format overrides it, and value(...) prints the requested fields tab-separated with no heading, one record per line. That is what the parsers below read, so none of the box drawing is ever parsed. Only resource output reaches stdout; the version banner, progress bars and trailers all go to stderr.

Caution

The two listing modes return different record types, and the difference is silent. --only-local-state reports what is installed from local state alone, with no network call, but its records carry neither latest_version_string nor state. The default mode fetches the remote snapshot and carries both. Asking for a field the mode does not have yields an empty column rather than an error, so installed and outdated deliberately use different modes.

Warning

The mutating operations below are refused outright when the SDK was installed through a distribution’s package manager: apt, yum, snap, Nix, the AUR and Google’s own Docker image all disable the component manager, and the error names the substitute command to use instead. They work normally on Homebrew, on Google’s interactive tarball install and on Windows. They are declared because that is a property of the installation rather than of the tool, and it surfaces as an ordinary command failure carrying a self-explanatory message.

No single-package upgrade. Naming components on components update expands the selection through both the dependency and the consumer closure, so upgrading one can touch its neighbours, which is not the per-package contract mpm’s upgrade <package> states. The positional is also hidden upstream and absent from the reference documentation. upgrade --all has no such problem and is declared.

No escalation is declared, and none could be. Whether a component operation needs root depends entirely on where the SDK was extracted: a user-owned install needs none, and Google’s own installer warns against running as root because it would leave the installation unusable for everyone else. A static privileged flag would break the common case to serve the rare one.

No search: no such command exists, and the component list is the whole catalog at around fifty entries, which mpm filters itself. Nothing maps to sync or cleanup.

What `mpm` adds to `gcloud`¶

mpm reaches across every manager at once, not gcloud alone: mpm installed and mpm outdated cover gcloud alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `gcloud` commands, in `mpm`¶

You already know gcloud: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `gcloud`	With `mpm`
List what’s installed	`gcloud components list --only-local-state --format=value(id,current_version_string)`	`mpm --gcloud installed`
List outdated packages	`gcloud components list --filter=state.name='Update Available' --format=value(id,current_version_string,latest_version_string)`	`mpm --gcloud outdated`
Install a package	`gcloud components install --quiet <package_id>`	`mpm install pkg:gcloud/<package_id>`
Upgrade everything	`gcloud components update --quiet`	`mpm --gcloud upgrade --all`
Remove a package	`gcloud components remove --quiet <package_id>`	`mpm remove pkg:gcloud/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`	✓
`orphans`
`search`
`install`	✓
`upgrade`
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `gcloud`¶

Deselect gcloud for a single run with --no-gcloud, or persist the choice in your configuration:

[mpm]
gcloud = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.gcloud]
timeout = 900

mpm config-template gcloud prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around gcloud, one mpm command each:

Snapshot and clone a machine: mpm --gcloud dump gcloud.toml, then mpm restore gcloud.toml on the next one.
Export a compliance SBOM: mpm --gcloud sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of Google Cloud CLI’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Google Cloud SDK components
Retraction: Vendor withdrawal only: components are published solely by Google and described by the snapshot the CLI fetches, so a version leaves by being dropped from that snapshot, which is also how a still-installed component comes to report itself as deprecated
Publish date: ❌ the snapshot names versions and their archives, carrying no publication date for a release-age gate to read

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ gcloud --version
Google Cloud SDK 578.0.0
bq 2.1.36
bundled-python3-unix 3.14.6
core 2026.07.24
gcloud-crc32c 1.0.0
gsutil 5.37

and extracted with:

r"^Google Cloud SDK[ \t]+(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Google Cloud CLI well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ gcloud components list --only-local-state --format=value(id,current_version_string)
bq	2.0.83
core	2026.07.24
gsutil	5.37

$ gcloud components list --filter=state.name='Update Available' --format=value(id,current_version_string,latest_version_string)
bq	2.0.83	2.0.84
gsutil	5.37	5.38

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --gcloud installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.7.0.dev0 (unreleased)
- Add the Google Cloud CLI’s component manager with installed, outdated, install, upgrade and remove support, shipped as a bundled definition. Listings go through --format=value(...), which prints tab-separated fields with no heading, bypassing the bordered table entirely. It declares no single-package upgrade: naming components expands the selection through their dependency and consumer closures.