Set a Proxy Environment on a Puppet exec Download

Puppet's exec resource has an environment attribute. Put the proxy values on the resource that invokes the downloader:

file { '/var/cache/myapp':
  ensure => directory,
}

exec { 'fetch-artifact':
  provider    => shell,
  command     => '/usr/bin/wget --tries=1 --timeout=20 -O /var/cache/myapp/artifact.part https://downloads.example.net/artifact-v1.bin && /usr/bin/mv /var/cache/myapp/artifact.part /var/cache/myapp/artifact-v1.bin',
  environment => [
    'http_proxy=http://proxy.example.net:8080',
    'https_proxy=http://proxy.example.net:8080',
  ],
  creates     => '/var/cache/myapp/artifact-v1.bin',
  require     => File['/var/cache/myapp'],
}

The example assumes Wget and mv at those paths. A failed transfer leaves the temporary pathname; the final pathname is installed only after Wget succeeds. The creates guard then skips later executions while the completed versioned file exists.

The environment array supplies values when Puppet runs this command. An HTTP entry from the HTTP proxy list can supply the proxy URL for an allowed public-artifact download when Wget has no configured or retained proxy credentials. An export performed by another exec resource lasts only in that other process and its descendants. Ordering two resources does not make the first one's shell environment persist into the second.

Keep this resource's environment with the resource. Other Puppet operations can use their own configured routes without changing the machine-wide Wget startup file.