I don't really know how to do this since the withenv block would need to know which extra paths to try but it's too early when the provider is validated (earlier than any class parameters are delivered).

The only idea I've had so far is to add a test whether we run on a PE machine or not and change the commands accordingly:

```puppet
  commands :openssl => 'openssl'

  if confine :is_pe => true
    commands :keytool => '/opt/puppet/bin/keytool'
  else
    commands :keytool => 'keytool'
  end
```

I've tried this and it works. I'm not sure if it's the best practice to introduce PE specific conditions in a general code though.

Any thoughts?