And how is that whitelist different from source_roots?