{"record":{"id":"de5d39ff4b09373a","repo":"puppetlabs/puppet","slug":"unable-to-connect-to-the-server-at-uri-detail","errorCode":null,"errorMessage":"Unable to connect to the server at %{uri}. Detail: %{detail}.","messagePattern":"Unable to connect to the server at %(.+?)\\. Detail: %(.+?)\\.","errorType":"http","errorClass":"Puppet::Forge::Errors::CommunicationError","httpStatus":null,"severity":"error","filePath":"lib/puppet/forge/repository.rb","lineNumber":56,"sourceCode":"        str += Puppet::Util.uri_encode(path)\n        uri = URI(str)\n\n        headers = { \"User-Agent\" => user_agent }\n\n        if forge_authorization\n          uri.user = nil\n          uri.password = nil\n          headers[\"Authorization\"] = forge_authorization\n        end\n\n        http = Puppet.runtime[:http]\n        response = http.get(uri, headers: headers, options: { ssl_context: @ssl_context })\n        io.write(response.body) if io.respond_to?(:write)\n        response\n      rescue Puppet::SSL::CertVerifyError => e\n        raise SSLVerifyError.new(:uri => @uri.to_s, :original => e.cause)\n      rescue => e\n        raise CommunicationError.new(:uri => @uri.to_s, :original => e)\n      end\n    end\n\n    def forge_authorization\n      if Puppet[:forge_authorization]\n        Puppet[:forge_authorization]\n      elsif Puppet.features.pe_license?\n        PELicense.load_license_key.authorization_token\n      end\n    end\n\n    # Return the local file name containing the data downloaded from the\n    # repository at +release+ (e.g. \"myuser-mymodule\").\n    def retrieve(release)\n      path = @host.chomp('/') + release\n      cache.retrieve(path)\n    end\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/forge/repository.rb#L38-L74","documentation":"set_sensitive_parameters runs when a resource declares sensitive => [name, ...]. For each name Puppet looks up the attribute: properties get sensitive = true, parameters get the adjacent cannot-redact warning, and this err fires when self.class.attrclass(name) is nil - the name is not defined on the resource type at all, most often a typo or an attribute borrowed from a different type. The consequence is worse than cosmetic: because the property you meant to redact was never marked, its value keeps appearing in logs and reports in clear text.","triggerScenarios":"sensitive => ['pasword'] (typo) on a user resource whose password property is set in clear text; listing an attribute that exists on another type (sensitive => ['content'] on package); referencing a property that was renamed or removed between module or Puppet versions; a name never registered via newproperty/newparam on a custom type.","commonSituations":"Hand-written manifests with spelling mistakes; copy-paste of sensitive lists between resource types; module upgrades that rename properties; custom types where the property is defined conditionally.","solutions":["Get the exact attribute list for the type: puppet describe user (or puppet describe -s user) and match spelling and case.","Fix the manifest entry to the real property name, then re-run with --noop and confirm the err is gone.","Apply the rule: only properties (state the provider syncs, like user#password) can be marked sensitive; parameters get the warning branch instead.","For custom types, declare the attribute with newproperty(:name) so attrclass resolves.","Audit earlier logs and reports for the clear-text value - runs before the fix logged it unredacted."],"exampleFix":"# before: typo means the real password property is never marked sensitive\nuser { 'alice':\n  ensure    => present,\n  password  => 'hunter2',\n  sensitive => ['pasword'],   # -> the property itself is not defined on user\n}\n\n# after: correct name; also prefer wrapping the value in Sensitive() for redaction at the source\nuser { 'alice':\n  ensure    => present,\n  password  => Sensitive('hunter2'),\n  sensitive => ['password'],\n}","handlingStrategy":"type-guard","validationCode":"# CI pre-flight: every sensitive=> name must be a real property of its type\nmanifests_with_sensitive.each do |type_name, names|\n  bad = names.reject { |n| sensitive_property?(type_name, n) }\n  fail \"#{type_name}: sensitive names not defined as properties: #{bad.join(', ')}\" unless bad.empty?\nend","typeGuard":"def sensitive_property?(type_name, name)\n  klass = Puppet::Type.type(type_name.to_sym)&.attrclass(name.to_sym)\n  klass.is_a?(Class) && klass < Puppet::Property\nend\n\nsensitive_property?(:user, 'password')  # => true\nsensitive_property?(:user, 'pasword')    # => false (would hit this err)","tryCatchPattern":null,"preventionTips":["Treat sensitive => entries like tests: verify each name against puppet describe <type> before merging.","Run --noop in CI and fail the build on any 'Unable to mark' err lines.","Prefer Sensitive('value') on the value itself - that redacts regardless of whether the metaparameter matches a property.","Remember only properties can be marked; parameters (require, subscribe, ...) cannot be redacted this way."],"tags":["puppet","sensitive","redaction","manifest","typo","custom-type"],"backgroundTag":"invalid-resource-attribute","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}