the TODO there is because the binary isn't "in" the Snapshot... it's outside. which we of course need to ban at some point, but anyway