Checksum is an internal api, and might fail on upgrades. Is it possible to use the remote_file resource? it does checksum comparison internally, but you have to provide the checksum upfront. In the example, your source file is located on the chef caching directory, what installs the file there? that resource can itself trigger the update, that way you wont need guards.
note: remote_file can also use file:/// as source. allowing you to copy a local file, in which case chef should do the checksum bits internally.