{"record":{"id":"5e1d1fe295071a6a","repo":"puppetlabs/puppet","slug":"purge-ssh-keys-must-be-true-false-or-an-array-of","errorCode":null,"errorMessage":"purge_ssh_keys must be true, false, or an array of file names, not %{value}","messagePattern":"purge_ssh_keys must be true, false, or an array of file names, not %(.+?)","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/user.rb","lineNumber":750,"sourceCode":"      # Use Symbols instead of booleans until PUP-1967 is resolved.\n      newvalues(:true, :false)\n\n      validate do |value|\n        if [:true, :false].include? value.to_s.intern\n          return\n        end\n\n        value = [value] if value.is_a?(String)\n        if value.is_a?(Array)\n          value.each do |entry|\n            raise ArgumentError, _(\"Each entry for purge_ssh_keys must be a string, not a %{klass}\") % { klass: entry.class } unless entry.is_a?(String)\n\n            valid_home = Puppet::Util.absolute_path?(entry) || entry =~ %r{^~/|^%h/}\n            raise ArgumentError, _(\"Paths to keyfiles must be absolute, not %{entry}\") % { entry: entry } unless valid_home\n          end\n          return\n        end\n        raise ArgumentError, _(\"purge_ssh_keys must be true, false, or an array of file names, not %{value}\") % { value: value.inspect }\n      end\n\n      munge do |value|\n        # Resolve string, boolean and symbol forms of true and false to a\n        # single representation.\n        case value\n        when :false, false, \"false\"\n          []\n        when :true, true, \"true\"\n          home = homedir\n          home ? [\"#{home}/.ssh/authorized_keys\"] : []\n        else\n          # value can be a string or array - munge each value\n          [value].flatten.filter_map do |entry|\n            authorized_keys_path(entry)\n          end\n        end\n      end","sourceCodeStart":732,"sourceCodeEnd":768,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/user.rb#L732-L768","documentation":"Raised by the validate block of the `purge_ssh_keys` property on the `user` type when the value is neither a true/false form (symbol, boolean, or their strings, accepted via newvalues(:true, :false) and the intern check), nor a String (treated as one path), nor an Array of path strings. Any other type — Hash, Integer, Symbol like :yes — fails through to this ArgumentError with value.inspect embedded.","triggerScenarios":"`purge_ssh_keys => 'yes'` (String, but fails the absolute-path companion check), `=> :yes`, `=> {'keys' => [...]}`, `=> 1`; JSON data where true arrives as the string 'TRUE' is fine, but arbitrary strings fall through to path validation.","commonSituations":"Hiera/JSON truthy variants ('yes'/'no' are NOT recognized — only 'true'/'false'); passing a hash of user→keys by mistake; ENC tools emitting symbols.","solutions":["Use a real boolean: `purge_ssh_keys => true` (purges keys in the user's ~/.ssh) or `=> false`","Or an array of absolute/home-relative path strings","Normalize truthy strings in the profile to a Boolean before passing"],"exampleFix":"# before\nuser { 'alice':\n  ensure          => present,\n  purge_ssh_keys  => 'yes',\n}\n\n# after\nuser { 'alice':\n  ensure          => present,\n  purge_ssh_keys  => true,\n}","handlingStrategy":"validation","validationCode":"# Normalize arbitrary truthy input to the three accepted shapes\nv = 'true' if v.to_s.downcase == 'yes'\nok = [true, false, 'true', 'false', :true, :false].include?(v) || (v.is_a?(Array) && v.all? { |e| e.is_a?(String) }) || v.is_a?(String)\nraise ArgumentError, \"purge_ssh_keys must be true/false or an array of paths, got #{v.inspect}\" unless ok","typeGuard":"def purge_ssh_keys_value?(v)\n  [TrueClass, FalseClass, String].any? { |c| v.is_a?(c) } || (v.is_a?(Array) && v.all? { |e| e.is_a?(String) })\nend","tryCatchPattern":null,"preventionTips":["Only use true/false booleans (or 'true'/'false' strings) — 'yes'/'no' are rejected","Type profile params as Variant[Boolean, Array[String]]","Validate ENC/Hiera output shapes before they reach the resource"],"tags":["puppet","user-resource","ssh-keys","type-validation"],"backgroundTag":"parameter-type-validation","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}