{"record":{"id":"235c14ce124928cb","repo":"puppetlabs/puppet","slug":"each-entry-for-purge-ssh-keys-must-be-a-string-no","errorCode":null,"errorMessage":"Each entry for purge_ssh_keys must be a string, not a %{klass}","messagePattern":"Each entry for purge_ssh_keys must be a string, not a %(.+?)","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/user.rb","lineNumber":743,"sourceCode":"        * An array of file paths --- look for keys in all of the files listed. Purge\n          any keys that aren't managed as `ssh_authorized_key` resources. If any of\n          these paths starts with `~` or `%h`, that token will be replaced with\n          the user's home directory.\"\n\n      defaultto :false\n\n      # Use Symbols instead of booleans until PUP-1967 is resolved.\n      newvalues(:true, :false)\n\n      validate do |value|\n        if [:true, :false].include? value.to_s.intern\n          return\n        end\n\n        value = [value] if value.is_a?(String)\n        if value.is_a?(Array)\n          value.each do |entry|\n            raise ArgumentError, _(\"Each entry for purge_ssh_keys must be a string, not a %{klass}\") % { klass: entry.class } unless entry.is_a?(String)\n\n            valid_home = Puppet::Util.absolute_path?(entry) || entry =~ %r{^~/|^%h/}\n            raise ArgumentError, _(\"Paths to keyfiles must be absolute, not %{entry}\") % { entry: entry } unless valid_home\n          end\n          return\n        end\n        raise ArgumentError, _(\"purge_ssh_keys must be true, false, or an array of file names, not %{value}\") % { value: value.inspect }\n      end\n\n      munge do |value|\n        # Resolve string, boolean and symbol forms of true and false to a\n        # single representation.\n        case value\n        when :false, false, \"false\"\n          []\n        when :true, true, \"true\"\n          home = homedir\n          home ? [\"#{home}/.ssh/authorized_keys\"] : []","sourceCodeStart":725,"sourceCodeEnd":761,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/user.rb#L725-L761","documentation":"Raised by the validate block of the `purge_ssh_keys` property on the `user` type. After allowing the true/false symbols, the value (a bare String is wrapped into a one-element array) must be an Array whose every entry is_a?(String); any non-String entry (Integer, nil, hash) raises this with the entry's class interpolated. Each string entry is then also required to be an absolute path or start with ~/ or %h/ (see the companion path error).","triggerScenarios":"`user { 'alice': purge_ssh_keys => [12345] }`, `=> [nil]`, `=> [{'path' => 'x'}]`; Hiera data mixing types; YAML unquoted values parsed as integers (e.g. a path like 2024).","commonSituations":"YAML bare tokens that parse as numbers; lookup() results merged from heterogeneous sources; programmatic generation of key lists that includes integers or nils.","solutions":["Ensure every entry is a string: `purge_ssh_keys => ['/etc/ssh/keys/alice/authorized_keys']`","Quote numeric-looking path components in YAML/Hiera","Map/clean the list in the profile: $keys.map |$k| { String($k) } before passing"],"exampleFix":"# before\nuser { 'alice':\n  ensure          => present,\n  purge_ssh_keys  => [12345],\n}\n\n# after\nuser { 'alice':\n  ensure          => present,\n  purge_ssh_keys  => ['/etc/ssh/keys/alice/authorized_keys'],\n}","handlingStrategy":"validation","validationCode":"keys = [raw].flatten.compact\nraise TypeError, 'purge_ssh_keys entries must be strings' unless keys.all? { |k| k.is_a?(String) }\nkeys = keys.map(&:to_s) rescue nil","typeGuard":"def valid_purge_keys?(v)\n  return true if [true, false].include?(v)\n  v.is_a?(Array) && v.all? { |e| e.is_a?(String) }\nend","tryCatchPattern":null,"preventionTips":["Quote all Hiera entries that could parse as YAML numbers","Type profile params as Variant[Boolean, Array[String]]","Run `puppet lookup --explain` to confirm data types at the boundary"],"tags":["puppet","user-resource","ssh-keys","purge","argument-validation"],"backgroundTag":"array-entry-type-validation","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}