This is no longer an issue using modern puppet and ruby:
[root@centos8-0 ~]# cat /etc/puppetlabs/code/environments/production/modules/ssl/manifests/init.pp
class ssl {
file { '/tmp/certs.crt':
ensure => file,
source => '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'
}
[root@centos8-0 ~]# file /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem: UTF-8 Unicode text
[root@centos8-0 ~]# puppet agent -t
...
Notice: /Stage[main]/Ssl/File[/tmp/certs.crt]/ensure: defined content as '{md5}b475cf36adf453881631cf53cadde457'
Debug: /Stage[main]/Ssl/File[/tmp/certs.crt]: The container Class[Ssl] will propagate my refresh event