Never actually handled optional-ness of Invoke import

Was just silently failing, wahoops

paramiko/config.py

@@ -380,6 +380,10 @@ def _does_match(self, match_list, target_hostname, canonical, options):
                 exec_cmd = self._tokenize(
                     options, target_hostname, "match-exec", param
                 )
+                # This is the laziest spot in which we can get mad about an
+                # inability to import Invoke.
+                if invoke is None:
+                    raise invoke_import_error
                 # Like OpenSSH, we 'redirect' stdout but let stderr bubble up
                 passed = invoke.run(exec_cmd, hide="stdout", warn=True).ok
             # Tackle any 'passed, but was negated' results from above

tests/test_config.py

@@ -702,6 +702,15 @@ def inner(command, *args, **kwargs):
 
 
 class TestMatchExec(object):
+    @patch("paramiko.config.invoke", new=None)
+    @patch("paramiko.config.invoke_import_error", new=ImportError("meh"))
+    def test_raises_invoke_ImportErrors_at_runtime(self):
+        # Not an ideal test, but I don't know of a non-bad way to fake out
+        # module-time ImportErrors. So we mock the symptoms. Meh!
+        with raises(ImportError) as info:
+            load_config("match-exec").lookup("oh-noes")
+        assert str(info.value) == "meh"
+
     @patch("paramiko.config.invoke.run")
     @mark.parametrize(
         "cmd,user",