I can *add* the checksum easily enough (SHA256 according to the Opscode documentation at http://docs.opscode.com/lwrp_dmg.html), but it doesn't do the right thing. Including the checksum "<sha256valuehere>" command will cause Chef to calculate the checksum against the real file but the result is silently ignored if it doesn't match.

$ sudo shasum -a 256 /var/chef/cache/DiffMerge.dmg 
e51579bd60d7c05eb055e8d898223d6cc4ac5d6c1998bbc641adc5a2760a4841  DiffMerge.dmg

This seems like a pretty serious bug in Chef for all users. Can you reproduce this on your Mac?