Run env-sourcing issue/renew execs via the shell provider

The command now starts with the shell builtin 'set -a', which the default
posix exec provider rejects ('Could not find command set') because it
requires an executable first word. Use provider => shell when the env.sh
prefix is present; the commands already rely on shell semantics
(>/dev/null, $(...)). Spec now declares an acme::request to cover the
issue/renew execs on the acme host.

Author: Scholdan

manifests/request.pp

@@ -165,9 +165,13 @@
     $env_file = "${cfg_dir}/profile_${use_profile}/env.sh"
     $env_prefix = "set -a && . \'${env_file}\' && set +a &&"
     $env_require = [File[$env_file]]
+    # The command now starts with a shell builtin; the default provider
+    # insists on an executable first word, so run it via /bin/sh.
+    $env_provider = 'shell'
   } else {
     $env_prefix = ''
     $env_require = []
+    $env_provider = undef
   }
 
   if defined('$_hook_params_pre') and ($_hook_params_pre =~ Hash) {
@@ -356,6 +360,7 @@
     unless      => $le_check_command,
     path        => $path,
     environment => $hook_params,
+    provider    => $env_provider,
     command     => $le_command_signcsr,
     timeout     => $acme::exec_timeout,
     # Run this exec only if no old cert can be found.
@@ -383,6 +388,7 @@
     unless      => $le_check_command,
     path        => $path,
     environment => $hook_params,
+    provider    => $env_provider,
     command     => $le_command_renew,
     timeout     => $acme::exec_timeout,
     returns     => [0,2],

spec/classes/acme_spec.rb

@@ -165,6 +165,18 @@
               profiles: sensitive(profiles),
             }
           end
+          # acme::request is normally collected as an exported resource; declare one directly.
+          let(:post_condition) do
+            <<-MANIFEST
+            acme::request { 'test.example.com':
+              csr         => 'dummy-csr',
+              altnames    => [],
+              use_account => '#{le_account}',
+              use_profile => 'pdns',
+              ca          => '#{le_ca}',
+            }
+            MANIFEST
+          end
 
           it { is_expected.to compile.with_all_deps }
           it { is_expected.to contain_class('acme::request::handler') }
@@ -176,6 +188,10 @@
           it { is_expected.to contain_file('/etc/acme.sh/configs/profile_pdns').with_ensure('directory').with_mode('0700') }
           it { is_expected.to contain_file('/etc/acme.sh/configs/profile_pdns/env.sh').with_mode('0600').with_show_diff(false).with_content(sensitive(%r{^export PDNS_Url='https://pdns.example.com'$})) }
           it { is_expected.to contain_file('/etc/acme.sh/configs/profile_pdns/env.sh').with_content(sensitive(%r{^export PDNS_Token='tok'\\''en'$})) }
+
+          # 'set -a' is a shell builtin: the exec must run through the shell provider
+          it { is_expected.to contain_exec('issue-certificate-test.example.com').with_provider('shell').with_command(%r{^set -a && \. '/etc/acme.sh/configs/profile_pdns/env\.sh' && set \+a && }) }
+          it { is_expected.to contain_exec('renew-certificate-test.example.com').with_provider('shell') }
         end
 
         context 'on Puppet Server with custom ca_whitelist' do