I would propose to also add a checksum to the whitelist (probably with also allowing any checksum). so you can also trace changing code.