Is there a guarantee that `pip install` download the exact same script as the GitHub one ? If not it seems risky.