{"record":{"id":"fc9c0470219e72eb","repo":"puppetlabs/puppet","slug":"you-cannot-use-mark-property-while-ensure-is-o","errorCode":null,"errorMessage":"You cannot use \"mark\" property while \"ensure\" is one of [\"absent\", \"purged\"]","messagePattern":"You cannot use \"mark\" property while \"ensure\" is one of \\[\"absent\", \"purged\"\\]","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/package.rb","lineNumber":711,"sourceCode":"        @should[0] if @should && @should.is_a?(Array) && @should.size == 1\n      end\n\n      def retrieve\n        provider.properties[:mark]\n      end\n\n      def sync\n        if @should[0] == :hold\n          provider.hold\n        else\n          provider.unhold\n        end\n      end\n    end\n\n    validate do\n      if @parameters[:mark] && [:absent, :purged].include?(@parameters[:ensure].should)\n        raise ArgumentError, _('You cannot use \"mark\" property while \"ensure\" is one of [\"absent\", \"purged\"]')\n      end\n    end\n  end\nend\n","sourceCodeStart":693,"sourceCodeEnd":716,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/package.rb#L693-L716","documentation":"The package type's resource-level validate (lib/puppet/type/package.rb:711) raises ArgumentError when the `mark` property is set while the desired `ensure` is `absent` or `purged`. Holding a package while simultaneously removing it is contradictory — the hold would block the removal (and purged also wipes config files).","triggerScenarios":"`package { 'sudo': ensure => absent, mark => hold }` or `ensure => purged` combined with any mark; template combos where a security baseline always sets mark => hold while another data source sets ensure => absent/purged for the same package.","commonSituations":"CIS-benchmark roles purging packages colliding with baselines that hold 'critical' packages; profile composition where mark is set unconditionally in a shared define and ensure comes from Hiera.","solutions":["Drop the `mark` attribute when ensure is absent/purged","Only set mark when ensure is an installed variant, e.g. guard with a conditional in the wrapper","If the package must stay held, change ensure to installed and remove it from the purge list"],"exampleFix":"# before\npackage { 'sudo':\n  ensure => purged,\n  mark   => hold,\n}\n\n# after\nif $ensure in ['absent', 'purged'] {\n  package { 'sudo': ensure => $ensure }\n} else {\n  package { 'sudo':\n    ensure => $ensure,\n    mark   => $mark,\n  }\n}","handlingStrategy":"validation","validationCode":"if $mark != undef and $ensure in ['absent', 'purged'] {\n  fail(\"mark cannot be used when ensure is '${ensure}'\")\n}","typeGuard":"def mark_compatible?(ensure_should, mark)\n  mark.nil? || !%w[absent purged].include?(ensure_should.to_s)\nend","tryCatchPattern":"begin\n  Puppet::Type.type(:package).new(name: 'sudo', ensure: :purged, mark: :hold)\nrescue ArgumentError => e\n  raise unless e.message.include?('mark')\n  # drop mark or change ensure, then rebuild\nend","preventionTips":["Keep hold/purge policy in one layer (Hiera or profile), not both","Test composed profiles with ensure variants in CI","Document that mark only applies to installed packages"],"tags":["puppet","package","parameter-conflict","purge"],"backgroundTag":"mutually-exclusive-parameters","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}