getSourceForPkgRecord installs from GitHub via SHA1 and not via file name