fix the mystery of the changing checksums

internal/op-client/checksum.go

@@ -20,8 +20,14 @@ func Checksum(fields []*op.ItemField) string {
 			continue
 		}
 		label := field.Label
-		if field.Section != nil && field.Section.ID != "" {
+		if field.Section != nil {
-			label = field.Section.ID + "." + label
+			sectionId := field.Section.Label
+			if sectionId == "" {
+				sectionId = field.Section.ID
+			}
+			if sectionId != "" {
+				label = sectionId + "." + label
+			}
 		}
 		df = append(df, label+field.Value)
 	}

internal/op-client/cli.go

@@ -45,15 +45,15 @@ type CLI struct {
 	DryRun bool // Won't write to 1Password
 }
 
-func (b *CLI) invoke(vault string, stdin *bytes.Buffer, args ...string) (bytes.Buffer, error) {
+func invoke(dryRun bool, vault string, stdin *bytes.Buffer, args ...string) (bytes.Buffer, error) {
 	if vault != "" {
 		args = append([]string{"--vault", shellescape.Quote(vault)}, args...)
 	}
 
 	argString := strings.Join(args, " ")
-	if b.DryRun {
+	if dryRun {
 		logrus.Warnf("dry-run: Would have invoked `op %s`", argString)
-		logrus.Warnf("dry-run: stdin `%s %s`", Path, stdin)
+		logrus.Warnf("dry-run: stdin `%s`", stdin)
 		return bytes.Buffer{}, nil
 	}
 
@@ -62,7 +62,7 @@ func (b *CLI) invoke(vault string, stdin *bytes.Buffer, args ...string) (bytes.B
 }
 
 func (b *CLI) Get(vault, name string) (*op.Item, error) {
-	stdout, err := b.invoke(vault, nil, "item", "--format", "json", "get", name)
+	stdout, err := invoke(false, vault, nil, "item", "--format", "json", "get", name)
 	if err != nil {
 		return nil, err
 	}
@@ -85,7 +85,7 @@ func (b *CLI) Create(item *op.Item) error {
 
 	stdin := bytes.NewBuffer(itemJSON)
 
-	_, err = b.invoke(item.Vault.ID, stdin, "item", "create")
+	_, err = invoke(b.DryRun, item.Vault.ID, stdin, "item", "create")
 	if err != nil {
 		return fmt.Errorf("could not create item: %w", err)
 	}
@@ -95,13 +95,14 @@ func (b *CLI) Create(item *op.Item) error {
 }
 
 func (b *CLI) Update(item *op.Item, remote *op.Item) error {
-	res, err := b.invoke("", nil, "--version")
+	res, err := invoke(false, "", nil, "--version")
 	if err == nil {
-		current, err := version.NewVersion(res.String())
+		v := strings.TrimSpace(res.String())
+		current, err := version.NewVersion(v)
 		if err == nil {
 			probedVersionModern = versionConstraint.Check(current)
 		} else {
-			logrus.Debugf("Failed parsing version <%s>: %s", res.String(), err)
+			logrus.Debugf("Failed parsing version <%s>: %s", v, err)
 		}
 	}
 
@@ -113,20 +114,18 @@ func (b *CLI) Update(item *op.Item, remote *op.Item) error {
 }
 
 func (b *CLI) UpdateModern(updated *op.Item, original *op.Item) error {
-	logrus.Infof("Creating new item: %s/%s", updated.Vault.ID, updated.Title)
-
 	itemJSON, err := json.Marshal(updated)
 	if err != nil {
 		return fmt.Errorf("could not serialize op item into json: %w", err)
 	}
 
 	stdin := bytes.NewBuffer(itemJSON)
-	_, err = b.invoke(updated.Vault.ID, stdin, "item", "edit", original.Title)
+	_, err = invoke(b.DryRun, updated.Vault.ID, stdin, "item", "edit", original.Title)
 	if err != nil {
 		return fmt.Errorf("could not create item: %w", err)
 	}
 
-	logrus.Infof("Item %s/%s created", updated.Vault.ID, updated.Title)
+	logrus.Infof("Item %s/%s updated", updated.Vault.ID, updated.Title)
 	return nil
 }
 
@@ -160,7 +159,7 @@ func (b *CLI) DeprecatedUpdate(updated *op.Item, original *op.Item) error {
 		logrus.Warnf("dry-run: Would have invoked op %v", args)
 		return nil
 	}
-	stdout, err := b.invoke(updated.Vault.ID, nil, args...)
+	stdout, err := invoke(b.DryRun, updated.Vault.ID, nil, args...)
 	if err != nil {
 		logrus.Errorf("op stderr: %s", stdout.String())
 		return err