I just saw this comment.   short of knowing the md5/sha-1 of the file before download, there is no way to know if the remote file is the same or not (a la http://download.tuxfamily.org/notepadplus/6.3.2/npp.6.3.2.digest.sha1).  That is a can of worms bigger than this commit.  

That said, I think based on @ferventcoder note-

$chocTempDir/foo-1.0.4/Install-foo-1.0.4.msi

will ensure no contamination from a same filename installer.