install/launchers/index.json records the SHA-256 of install.py that --add-app checks, and the page listed only the pins of install.sh and install.ps1 as what a change to install.py rewrites.