url2 = 'http://deb.debian.org/debian//pool/main/l/lxqt-config/lxqt-config_0.14.1.orig.tar.xz.asc'

# patched download to not check anything
In [10]: download(url2, dest='/tmp')
Out[10]:
('/tmp/lxqt-config_0.14.1.orig.tar.xz.asc',
 {'length': 668,
  'filename': 'lxqt-config_0.14.1.orig.tar.xz.asc',
  'checksums': {'blake2s256': '4a61c6af7baa8614858dd62f45212b68534fcaa9abc35b6d73cb68177c0de5f6',
   'sha1_git': '894b9f8c548e7f1c785615138226b1777e585771',
   'sha1': 'e5036664fd78a37dd0bf3f28cae627e2be6ebfc5',
   'sha256': '7fed8327320b1920f92ed343bf7a8c0ce4b7d35e8aef49e744684de3071e8691'}})

# from loader input
input_meta = {
    ...: 'md5sum': 'ab8d5da67ceb732cbec3b91d5db6d2f2',
    ...: 'name': 'lxqt-config_0.14.1.orig.tar.xz.asc',
    ...: 'sha256': '7fed8327320b1920f92ed343bf7a8c0ce4b7d35e8aef49e744684de3071e8691',
    ...: 'size': 833,
    ...: 'uri': 'http://deb.debian.org/debian//pool/main/l/lxqt-config/lxqt-config_0.14.1.orig.tar.xz.asc'
    ...: }

# sha256 is correct
# length/size is different

In [14]: r = requests.get(url2)

In [15]: r.ok
Out[15]: True

In [16]: r.headers.get('content-length')
Out[16]: '668'

# but apparently that comes from the content-length header...

In [17]: len(r.content)
Out[17]: 833