Checksum and size for chezmoi externals

[vbrand1984]

Consider I create an entry in .chezmoiexternal.toml to download an archive from my Google Drive:

["foo/bar"]
	type = "archive"
	url = "https://drive.google.com/uc?export=foobar"
	format = "tar.zst"
	checksum.sha256 = "061945a451a127a0f5816dda8451db4a801229ff063888219f1bb309551df44f"
	checksum.size = 3896650
	refreshPeriod = 0

This file will be downloaded just once, apparently. Then I re-upload a new version of this archive to my Google Drive and make it available under the same link. Then I change the checksum.sha256 and checksum.size in the .chezmoiexternal.toml file accordingly. Will chezmoi consider this as a new file and will it re-download it when expected size and SHA sum are changed?

Also, I've noticed that when specified SHA sum mismatches that of the file, chezmoi gives an alarm and stops working, but when the sizes mismatch, it works and applies everything as if nothing wrong is happening. Is this an OK behaviour or checksum.size just isn't checked properly?

[twpayne]

Will chezmoi consider this as a new file and will it re-download it when expected size and SHA sum are changed?

No. chezmoi only uses the URL. Once you specify refreshPeriod = 0 chezmoi will only ever download the file once.

Also, I've noticed that when specified SHA sum mismatches that of the file, chezmoi gives an alarm and stops working, but when the sizes mismatch, it works and applies everything as if nothing wrong is happening. Is this an OK behaviour or checksum.size just isn't checked properly?

This sounds like a bug in chezmoi. Note that there's no reason to specify both checksum.size and checksum.sha256 because if the size is incorrect then the SHA256 checksum will also not match, and checking the SHA256 is much more secure than checking the size. Checking the size adds nothing.

[vbrand1984]

Got it, thank you, @twpayne