puppetlabs/puppet · error · ArgumentError

Invalid value '%{value}' for parameter %{name}. Allowed valu

Error message

Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'

What it means

Validation raised by the `:hook` proc for the `supported_checksum_types` setting. Assigned values are munged to an array and each must appear in `Puppet.valid_file_checksum_types` (md5, sha1, sha224, sha256, sha384, sha512 — with md5 excluded on FIPS-restricted builds); the first invalid value is reported along with the full allowlist. The setting constrains which digests the agent accepts for file resources in static catalogs, so an unsupported type is rejected at config-parse time.

Source

Thrown at lib/puppet/defaults.rb:1103

        :type     => :enum,
        :values   => valid_digest_algorithms,
        :desc     => "Which digest algorithm to use for file resources and the filebucket.
                      Valid values are #{valid_digest_algorithms.join(', ')}. Default is
                      #{default_digest_algorithm}.",
    },
    :supported_checksum_types => {
      :default => -> { default_file_checksum_types },
      :type    => :array,
      :desc    => "Checksum types supported by this agent for use in file resources of a
                   static catalog. Values must be comma-separated. Valid types are
                   #{valid_file_checksum_types.join(', ')}. Default is
                   #{default_file_checksum_types.join(', ')}.",
      :hook    => proc do |value|
        values = munge(value)

        invalid = values - Puppet.valid_file_checksum_types
        unless invalid.empty?
          raise ArgumentError, _("Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'") % {
            value: invalid.first, name: @name, allowed_values: Puppet.valid_file_checksum_types.join("', '")
          }
        end
      end
    },
    :logdest => {
      :type      => :string,
      :desc      => "Where to send log messages. Choose between 'syslog' (the POSIX syslog
      service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
      file. Multiple destinations can be set using a comma separated list (eg: `/path/file1,console,/path/file2`)"
      # Sure would be nice to set the Puppet::Util::Log destination here in an :on_initialize_and_write hook,
      # unfortunately we have a large number of tests that rely on the logging not resetting itself when the
      # settings are initialized as they test what gets logged during settings initialization.
    }
  )

    settings.define_settings(
    :ca,

View on GitHub (pinned to e227c27540)

Solutions

Set only valid digests, e.g. `supported_checksum_types = sha256, sha384, sha512`
On FIPS systems remove md5 and sha1 entirely
Fix the value at its source: puppet.conf, PE classifier setting, or the module/hiera data that writes it

Example fix

# before
[main]
supported_checksum_types = md5, crc32
# after
[main]
supported_checksum_types = sha256

Defensive patterns

Strategy: validation

Validate before calling

values = raw_setting.split(',').map(&:strip).reject(&:empty?).map(&:to_sym)
invalid = values - Puppet.valid_file_checksum_types
raise ArgumentError, "unsupported checksum types: #{invalid.join(',')}" unless invalid.empty?
Puppet[:supported_checksum_types] = values.map(&:to_s)

Type guard

def valid_checksum_types?(raw)
  (raw.to_s.split(',').map(&:strip).map(&:to_sym) - Puppet.valid_file_checksum_types).empty?
end

Prevention

Standardize on sha256 for the setting; it is valid everywhere including FIPS
Never migrate Puppet 3 configs wholesale — re-derive settings like this one
On FIPS hosts, audit for lingering md5/sha1 values after enablement

When it happens

Trigger: `supported_checksum_types = crc32, mtime` (legacy checksum names were never valid here); listing `md5` or `sha1` on a FIPS-enabled agent where valid_file_checksum_types excludes them; assignment via `Puppet[:supported_checksum_types]=`, hiera data, or a module managing puppet.conf.

Common situations: FIPS hardening leaving a stale md5 in the config; settings inherited from Puppet 3-era configs; PE console-managed agent settings after an upgrade; typos like `sha-256` instead of `sha256`.

Related errors

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/155c97b1dff44b47. Report an issue: GitHub.