{"record":{"id":"155c97b1dff44b47","repo":"puppetlabs/puppet","slug":"invalid-value-value-for-parameter-name-al","errorCode":null,"errorMessage":"Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'","messagePattern":"Invalid value '%(.+?)' for parameter %(.+?)\\. Allowed values are '%(.+?)'","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/defaults.rb","lineNumber":1103,"sourceCode":"        :type     => :enum,\n        :values   => valid_digest_algorithms,\n        :desc     => \"Which digest algorithm to use for file resources and the filebucket.\n                      Valid values are #{valid_digest_algorithms.join(', ')}. Default is\n                      #{default_digest_algorithm}.\",\n    },\n    :supported_checksum_types => {\n      :default => -> { default_file_checksum_types },\n      :type    => :array,\n      :desc    => \"Checksum types supported by this agent for use in file resources of a\n                   static catalog. Values must be comma-separated. Valid types are\n                   #{valid_file_checksum_types.join(', ')}. Default is\n                   #{default_file_checksum_types.join(', ')}.\",\n      :hook    => proc do |value|\n        values = munge(value)\n\n        invalid = values - Puppet.valid_file_checksum_types\n        unless invalid.empty?\n          raise ArgumentError, _(\"Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'\") % {\n            value: invalid.first, name: @name, allowed_values: Puppet.valid_file_checksum_types.join(\"', '\")\n          }\n        end\n      end\n    },\n    :logdest => {\n      :type      => :string,\n      :desc      => \"Where to send log messages. Choose between 'syslog' (the POSIX syslog\n      service), 'eventlog' (the Windows Event Log), 'console', or the path to a log\n      file. Multiple destinations can be set using a comma separated list (eg: `/path/file1,console,/path/file2`)\"\n      # Sure would be nice to set the Puppet::Util::Log destination here in an :on_initialize_and_write hook,\n      # unfortunately we have a large number of tests that rely on the logging not resetting itself when the\n      # settings are initialized as they test what gets logged during settings initialization.\n    }\n  )\n\n    settings.define_settings(\n    :ca,","sourceCodeStart":1085,"sourceCodeEnd":1121,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/defaults.rb#L1085-L1121","documentation":"Validation raised by the `:hook` proc for the `supported_checksum_types` setting. Assigned values are munged to an array and each must appear in `Puppet.valid_file_checksum_types` (md5, sha1, sha224, sha256, sha384, sha512 — with md5 excluded on FIPS-restricted builds); the first invalid value is reported along with the full allowlist. The setting constrains which digests the agent accepts for file resources in static catalogs, so an unsupported type is rejected at config-parse time.","triggerScenarios":"`supported_checksum_types = crc32, mtime` (legacy checksum names were never valid here); listing `md5` or `sha1` on a FIPS-enabled agent where valid_file_checksum_types excludes them; assignment via `Puppet[:supported_checksum_types]=`, hiera data, or a module managing puppet.conf.","commonSituations":"FIPS hardening leaving a stale md5 in the config; settings inherited from Puppet 3-era configs; PE console-managed agent settings after an upgrade; typos like `sha-256` instead of `sha256`.","solutions":["Set only valid digests, e.g. `supported_checksum_types = sha256, sha384, sha512`","On FIPS systems remove md5 and sha1 entirely","Fix the value at its source: puppet.conf, PE classifier setting, or the module/hiera data that writes it"],"exampleFix":"# before\n[main]\nsupported_checksum_types = md5, crc32\n# after\n[main]\nsupported_checksum_types = sha256","handlingStrategy":"validation","validationCode":"values = raw_setting.split(',').map(&:strip).reject(&:empty?).map(&:to_sym)\ninvalid = values - Puppet.valid_file_checksum_types\nraise ArgumentError, \"unsupported checksum types: #{invalid.join(',')}\" unless invalid.empty?\nPuppet[:supported_checksum_types] = values.map(&:to_s)","typeGuard":"def valid_checksum_types?(raw)\n  (raw.to_s.split(',').map(&:strip).map(&:to_sym) - Puppet.valid_file_checksum_types).empty?\nend","tryCatchPattern":null,"preventionTips":["Standardize on sha256 for the setting; it is valid everywhere including FIPS","Never migrate Puppet 3 configs wholesale — re-derive settings like this one","On FIPS hosts, audit for lingering md5/sha1 values after enablement"],"tags":["puppet-conf","settings","checksum","fips","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}