In my testing, it didn't. It would use the checksum to avoid re-downloading if the file already existed and the checksum matched, but wouldn't validate the checksum on download and fail if it didn't match. (Instead, it would re-download on every run.) Since the download is over http and coming from a mirror, I'd like to validate it.

The ruby_block is based on this, where someone else had a similar problem: http://tech.yipit.com/2013/05/09/pragmatic-chef-verifying-remote-files/