antigravity
The package downloads prebuilt binaries from Google's official storage domain for a legitimate product; while the host is not always whitelisted, it is a trusted vendor source, and the binaries are verified with b2sums, reducing supply-chain risk.
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from Google's official storage domain for a legitimate product; while the host is not always whitelisted, it is a trusted vendor source, and the binaries are verified with b2sums, reducing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:37
source_x86_64=(Antigravity-$pkgver-x86_64.tar.gz::https://storage.googleapis.com/antigravity-public/antigravity-hub/$pkgver-$_build/linux-x64/Antigravity.tar.gz)
PKGBUILD
1 offending line(s) highlighted# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
pkgname=antigravity
pkgver=2.14.0
pkgrel=1
pkgdesc='Google Antigravity 2.0 multi-agent orchestration platform'
arch=(aarch64 x86_64)
url=https://antigravity.google/product/antigravity-2
license=(LicenseRef-Google-Antigravity)
depends=(alsa-lib
at-spi2-core
cairo
dbus
expat
glib2
glibc
gtk3
libcups
libgcc
libx11
libxcb
libxcomposite
libxdamage
libxext
libxfixes
libxkbcommon
libxrandr
mesa
nspr
nss
pango
systemd-libs)
options=(!strip !debug)
source=(antigravity.desktop
antigravity.png)
_build=5449404535144448
source_x86_64=(Antigravity-$pkgver-x86_64.tar.gz::https://storage.googleapis.com/antigravity-public/antigravity-hub/$pkgver-$_build/linux-x64/Antigravity.tar.gz)
source_aarch64=(Antigravity-$pkgver-aarch64.tar.gz::https://storage.googleapis.com/antigravity-public/antigravity-hub/$pkgver-$_build/linux-arm/Antigravity.tar.gz)
b2sums=('ec2c74f0e6f2458f2ef1c67b1321c058a3f7c422e364d8871a0a933220ec52ee5736e449cb797b6f135cff1f4adfe6f81e0fdbc76d3ec67c245aea002b8577d8'
'772849ebf4574dccc7d2fc30751baed10b4a5d4091c524f3d69938192387693501c0c54ea5b43fa2ed382f70ecdff369a4c65ce3d0f778c68712fa0c2b5e84b8')
b2sums_aarch64=('47bf9f6f885be58d857e7fe6c6140ce52ef368db8ffc68bf5bd09b2f8cb070302398235c5a381e8b9bd95fad30b44250883fe006f672f50a7ed39537f718b34d')
b2sums_x86_64=('78bad4890b98641b90829257001467148af7dea842c800a83727963518a39645469e25025383f645d2b3c1839a5a43bc28a458e6b5236f5f4983fdd1e4ab0910')
package() {
install -d "$pkgdir/opt"
cp -a Antigravity-*/ "$pkgdir/opt/Antigravity"
install -d "$pkgdir/usr/bin"
ln -s /opt/Antigravity/antigravity "$pkgdir/usr/bin/$pkgname"
install -d "$pkgdir/usr/share/licenses/$pkgname"
ln -s /opt/Antigravity/LICENSE.electron.txt -t "$pkgdir/usr/share/licenses/$pkgname"
ln -s /opt/Antigravity/LICENSES.chromium.html -t "$pkgdir/usr/share/licenses/$pkgname"
install -Dm644 $pkgname.desktop -t "$pkgdir/usr/share/applications"
install -Dm644 $pkgname.png -t "$pkgdir/usr/share/pixmaps"
}
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: AlphaLynx <alphalynx at alphalynx dot dev> pkgname=antigravity-pkgver=2.13.0+pkgver=2.14.0 pkgrel=1 pkgdesc='Google Antigravity 2.0 multi-agent orchestration platform' arch=(aarch64 x86_64)@@ -33,13 +33,13 @@ options=(!strip !debug) source=(antigravity.desktop antigravity.png)-_build=6362815968182272+_build=5449404535144448 source_x86_64=(Antigravity-$pkgver-x86_64.tar.gz::https://storage.googleapis.com/antigravity-public/antigravity-hub/$pkgver-$_build/linux-x64/Antigravity.tar.gz) source_aarch64=(Antigravity-$pkgver-aarch64.tar.gz::https://storage.googleapis.com/antigravity-public/antigravity-hub/$pkgver-$_build/linux-arm/Antigravity.tar.gz) b2sums=('ec2c74f0e6f2458f2ef1c67b1321c058a3f7c422e364d8871a0a933220ec52ee5736e449cb797b6f135cff1f4adfe6f81e0fdbc76d3ec67c245aea002b8577d8' '772849ebf4574dccc7d2fc30751baed10b4a5d4091c524f3d69938192387693501c0c54ea5b43fa2ed382f70ecdff369a4c65ce3d0f778c68712fa0c2b5e84b8')-b2sums_aarch64=('a83e260859bbd53a5eddf7bb268737946b9e3957ad793ebad24046055776ee4d1e75ba0ba33baf6c343392a3cec5ccaaff9aeae5a1c81c87d0f87457ddb29026')-b2sums_x86_64=('c3201c068eaee99636576aaa1d3680aee82b2211ece8822b2f98a7e776d0da717b6f5c5097d3b27bb4a29d23a566021a086916303b1d820f0cd7648b6f1ff162')+b2sums_aarch64=('47bf9f6f885be58d857e7fe6c6140ce52ef368db8ffc68bf5bd09b2f8cb070302398235c5a381e8b9bd95fad30b44250883fe006f672f50a7ed39537f718b34d')+b2sums_x86_64=('78bad4890b98641b90829257001467148af7dea842c800a83727963518a39645469e25025383f645d2b3c1839a5a43bc28a458e6b5236f5f4983fdd1e4ab0910') package() { install -d "$pkgdir/opt"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 23:24:19 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 05:13:46 | Medium | 1 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 23:12:41 | Medium | 1 |
| 2026-09-02 00:02:31 | Clean | 2 |
| 2026-09-01 13:48:42 | Medium | 1 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |