Remove explicit "-a public-read" from gsutil calls.

They break once we switch to bucket-level permissions and they're unnecessary, because the buckets are public readable anyway, already.

PiperOrigin-RevId: 243990103
diff --git a/scripts/ci/build.sh b/scripts/ci/build.sh
index 1951f0f..c5c526d 100755
--- a/scripts/ci/build.sh
+++ b/scripts/ci/build.sh
@@ -185,7 +185,7 @@
       release_path="${release_name}/rc${rc}"
     fi
     create_index_html "${artifact_dir}" > "${artifact_dir}/index.html"
-    gsutil -m cp -a public-read "${artifact_dir}/**" "gs://bazel/${release_path}"
+    gsutil -m cp "${artifact_dir}/**" "gs://bazel/${release_path}"
   fi
 }
 
@@ -259,7 +259,7 @@
   reprepro -C jdk1.8 includedeb "${distribution}" "${deb_pkg_name}"
   reprepro -C jdk1.8 includedsc "${distribution}" "${deb_dsc_name}"
 
-  gsutil -m cp -a public-read -r dists pool "gs://bazel-apt"
+  gsutil -m cp -r dists pool "gs://bazel-apt"
 }
 
 function release_to_apt() {
diff --git a/scripts/docs/generate_versioned_docs.sh b/scripts/docs/generate_versioned_docs.sh
index 741d59c..fb232c6 100755
--- a/scripts/docs/generate_versioned_docs.sh
+++ b/scripts/docs/generate_versioned_docs.sh
@@ -61,7 +61,7 @@
   # should there be such a need, please file an issue.
   #
   # -a public-read: set the default ACL for uploaded archives to public-read for Bazel to download it.
-  gsutil cp -n -a public-read $(cd $SCRIPT_DIR && bazel info bazel-genfiles)/site/jekyll-tree.tar gs://bazel-mirror/bazel_versioned_docs/jekyll-tree-$DOC_VERSION.tar
+  gsutil cp -n $(cd $SCRIPT_DIR && bazel info bazel-genfiles)/site/jekyll-tree.tar gs://bazel-mirror/bazel_versioned_docs/jekyll-tree-$DOC_VERSION.tar
 
   log_info "Done."
   log_info "Now, please add \"$DOC_VERSION\" to the doc_versions list in <workspace>/site/_config.yml."
diff --git a/tools/android/runtime_deps/upload_android_tools.sh b/tools/android/runtime_deps/upload_android_tools.sh
index 00c461a..a9961d2 100755
--- a/tools/android/runtime_deps/upload_android_tools.sh
+++ b/tools/android/runtime_deps/upload_android_tools.sh
@@ -51,6 +51,5 @@
 
 # Upload the tarball to GCS.
 # -n for no-clobber, so we don't overwrite existing files
-# -a public-read to make this tarball public
-gsutil cp -n -a public-read $versioned_android_tools_archive \
+gsutil cp -n $versioned_android_tools_archive \
   gs://bazel-mirror/bazel_android_tools/$VERSIONED_FILENAME