puppetlabs/puppet · error · ArgumentError

You cannot use "mark" property while "ensure" is one of ["ab

Error message

You cannot use "mark" property while "ensure" is one of ["absent", "purged"]

What it means

The package type's resource-level validate (lib/puppet/type/package.rb:711) raises ArgumentError when the `mark` property is set while the desired `ensure` is `absent` or `purged`. Holding a package while simultaneously removing it is contradictory — the hold would block the removal (and purged also wipes config files).

Source

Thrown at lib/puppet/type/package.rb:711

        @should[0] if @should && @should.is_a?(Array) && @should.size == 1
      end

      def retrieve
        provider.properties[:mark]
      end

      def sync
        if @should[0] == :hold
          provider.hold
        else
          provider.unhold
        end
      end
    end

    validate do
      if @parameters[:mark] && [:absent, :purged].include?(@parameters[:ensure].should)
        raise ArgumentError, _('You cannot use "mark" property while "ensure" is one of ["absent", "purged"]')
      end
    end
  end
end

View on GitHub (pinned to e227c27540)

Solutions

1. Drop the `mark` attribute when ensure is absent/purged
2. Only set mark when ensure is an installed variant, e.g. guard with a conditional in the wrapper
3. If the package must stay held, change ensure to installed and remove it from the purge list

Example fix

# before
package { 'sudo':
  ensure => purged,
  mark   => hold,
}

# after
if $ensure in ['absent', 'purged'] {
  package { 'sudo': ensure => $ensure }
} else {
  package { 'sudo':
    ensure => $ensure,
    mark   => $mark,
  }
}

if $mark != undef and $ensure in ['absent', 'purged'] {
  fail("mark cannot be used when ensure is '${ensure}'")
}

def mark_compatible?(ensure_should, mark)
  mark.nil? || !%w[absent purged].include?(ensure_should.to_s)
end

begin
  Puppet::Type.type(:package).new(name: 'sudo', ensure: :purged, mark: :hold)
rescue ArgumentError => e
  raise unless e.message.include?('mark')
  # drop mark or change ensure, then rebuild
end

When it happens

Trigger: `package { 'sudo': ensure => absent, mark => hold }` or `ensure => purged` combined with any mark; template combos where a security baseline always sets mark => hold while another data source sets ensure => absent/purged for the same package.

Common situations: CIS-benchmark roles purging packages colliding with baselines that hold 'critical' packages; profile composition where mark is set unconditionally in a shared define and ensure comes from Hiera.

Related errors

• Cannot have both `ensure => disabled` and `enable_only => tr
• Invalid %{resource} provider '%{provider_class}'
• Name must be a String not %{klass}
• Cannot have both `ensure => disabled` and `flavor`
• Cannot have both `enable_only => true` and `flavor`

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/fc9c0470219e72eb. Report an issue: GitHub.