{"record":{"id":"aa01c0f9748ecd17","repo":"puppetlabs/puppet","slug":"cannot-have-both-ensure-disabled-and-enable","errorCode":null,"errorMessage":"Cannot have both `ensure => disabled` and `enable_only => true`","messagePattern":"Cannot have both `ensure => disabled` and `enable_only => true`","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/package.rb","lineNumber":523,"sourceCode":"    newparam(:enable_only, :boolean => false, :parent => Puppet::Parameter::Boolean) do\n      desc <<-EOT\n        Tells `dnf module` to only enable a specific module, instead\n        of installing its default profile.\n\n        Modules with no default profile will be enabled automatically\n        without the use of this parameter.\n\n        Conflicts with the `flavor` property, which selects a profile\n        to install.\n      EOT\n      defaultto false\n\n      validate do |value|\n        if [true, :true, \"true\"].include?(value) && @resource[:flavor]\n          raise ArgumentError, _('Cannot have both `enable_only => true` and `flavor`')\n        end\n        if [:disabled, \"disabled\"].include?(@resource[:ensure])\n          raise ArgumentError, _('Cannot have both `ensure => disabled` and `enable_only => true`')\n        end\n      end\n    end\n\n    newparam(:install_only, :boolean => false, :parent => Puppet::Parameter::Boolean, :required_features => :install_only) do\n      desc <<-EOT\n        It should be set for packages that should only ever be installed,\n        never updated. Kernels in particular fall into this category.\n      EOT\n      defaultto false\n    end\n\n    newparam(:install_options, :parent => Puppet::Parameter::PackageOptions, :required_features => :install_options) do\n      desc <<-EOT\n        An array of additional options to pass when installing a package. These\n        options are package-specific, and should be documented by the software\n        vendor.  One commonly implemented option is `INSTALLDIR`:\n","sourceCodeStart":505,"sourceCodeEnd":541,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/package.rb#L505-L541","documentation":"Puppet's package type parameter `enable_only => true` restricts Puppet to managing only the package's service enablement state (no install/update). The validate block rejects combining it with `ensure => disabled`, because 'disabled' is an ensure state that itself means 'install nothing and disable the service' — enabling-only management of a package you also declare disabled is contradictory. It raises ArgumentError at catalog compilation time (lib/puppet/type/package.rb:523).","triggerScenarios":"Declaring `package { 'x': ensure => disabled, enable_only => true }` (symbol or string form of 'disabled'); wrapper classes/modules that parametrize `$ensure` while hardcoding `enable_only => true`, so a Hiera value of 'disabled' trips it during compile.","commonSituations":"Hardening profiles that disable optional packages meeting shared package defines that always set enable_only; refactors where `ensure => disabled` replaced older `ensure => absent` + `enable => false` combos; copy-paste from Windows/NuGet package examples that use enable_only.","solutions":["Remove `enable_only => true` and keep `ensure => disabled` — it already disables the service without installing","Keep `enable_only => true` but change ensure to an installed state (e.g. `ensure => installed`) and disable the service with `enable => false`","In wrapper classes, parametrize both values and fail() early with your own message when the pair is contradictory"],"exampleFix":"# before\npackage { 'telnet':\n  ensure      => disabled,\n  enable_only => true,\n}\n\n# after\npackage { 'telnet':\n  ensure => disabled,\n}","handlingStrategy":"validation","validationCode":"# wrapper class guard, before declaring the package\nif $enable_only and $ensure == 'disabled' {\n  fail(\"package '${title}': enable_only => true cannot be combined with ensure => disabled\")\n}\npackage { $title:\n  ensure      => $ensure,\n  enable_only => $enable_only,\n}","typeGuard":"def enable_only_compatible?(ensure_val, enable_only)\n  !(enable_only && ensure_val.to_s == 'disabled')\nend","tryCatchPattern":"begin\n  Puppet::Type.type(:package).new(\n    name: 'telnet', ensure: :disabled, enable_only: true\n  )\nrescue ArgumentError => e\n  # deterministic misconfiguration; fix inputs, do not retry\n  raise unless e.message.include?('enable_only')\nend","preventionTips":["Treat `enable_only` as a niche flag for enablement-only management; do not set it in shared package defines","Prefer `ensure => disabled` or `enable => false` to express disablement","Unit-test wrapper classes with both ensure=present and ensure=disabled inputs in CI"],"tags":["puppet","package","parameter-conflict","catalog-compilation"],"backgroundTag":"mutually-exclusive-parameters","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}