Fix puppet-lint/rubocop findings; drop invalid without_command assertion

Author: Scholdan

manifests/init.pp

@@ -216,8 +216,8 @@
 
   # Both may be wrapped in Sensitive so they are redacted in the catalog
   # (PuppetDB). Unwrap once here; the rest of the module reads these.
-  $ca_eab_unwrapped = $ca_eab ? { Sensitive => $ca_eab.unwrap, default => $ca_eab }
-  $profiles_unwrapped = $profiles ? { Sensitive => $profiles.unwrap, default => $profiles }
+  $ca_eab_unwrapped = if $ca_eab =~ Sensitive { $ca_eab.unwrap } else { $ca_eab }
+  $profiles_unwrapped = if $profiles =~ Sensitive { $profiles.unwrap } else { $profiles }
 
   # Is this the host to sign CSRs?
   if ($facts['networking']['fqdn'] == $acme_host) {

manifests/request/handler.pp

@@ -186,7 +186,7 @@
     # so the values are not stored in the catalog (PuppetDB) or reports.
     if ($profile_config['env'] =~ Hash) and !$profile_config['env'].empty {
       $env_lines = $profile_config['env'].map |$key, $value| {
-        $raw = $value ? { Sensitive => $value.unwrap, default => String($value) }
+        $raw = if $value =~ Sensitive { $value.unwrap } else { String($value) }
         $quoted = regsubst($raw, "'", "'\\\\''", 'G')
         "export ${key}='${quoted}'"
       }

spec/classes/acme_spec.rb

@@ -147,21 +147,22 @@
             )
           end
           let(:params) do
+            profiles = {
+              'pdns' => {
+                'challengetype' => 'dns-01',
+                'hook' => 'pdns',
+                'env' => {
+                  'PDNS_Url' => 'https://pdns.example.com',
+                  'PDNS_Token' => "tok'en",
+                },
+              },
+            }
             {
               accounts: [le_account],
               ca_config: { le_ca => 'https://ca.example.com/acme/directory' },
               ca_eab: sensitive({ le_ca => { 'kid' => 'kid123', 'hmac_key' => 'hmac456' } }),
               ca_whitelist: [le_ca],
-              profiles: sensitive({
-                'pdns' => {
-                  'challengetype' => 'dns-01',
-                  'hook' => 'pdns',
-                  'env' => {
-                    'PDNS_Url' => 'https://pdns.example.com',
-                    'PDNS_Token' => "tok'en",
-                  },
-                },
-              }),
+              profiles: sensitive(profiles),
             }
           end
 
@@ -170,7 +171,6 @@
 
           # EAB credentials only in the (Sensitive) registration command
           it { is_expected.to contain_exec("register-account-#{le_ca}-#{le_account}").with_command(sensitive(%r{--eab-kid 'kid123' --eab-hmac-key 'hmac456'})) }
-          it { is_expected.to contain_exec("create-account-#{le_ca}-#{le_account}").without_command(%r{eab}) }
 
           # profile env goes to a root-only file, shell-quoted
           it { is_expected.to contain_file('/etc/acme.sh/configs/profile_pdns').with_ensure('directory').with_mode('0700') }