Setting user passwords fails on distro-packaged puppet 8

TL;DR

Issue puppetlabs/puppet#9320 (closed, 6 comments): user { password value > Sensitive(...) } failed on Fedora 39 with puppet 8.3.1 installed from distro packages. The maintainer traced it to the distro shipping an old libshadow against Ruby 3.2; the libshadow fix lives in puppet-runtime.

Steps

1. Issue puppetlabs/puppet#9320 (closed, 6 comments): user { password value > Sensitive(...) } failed on Fedora 39 with puppet 8.3.1 installed from distro packages. The maintainer traced it to the distro shipping an old libshadow against Ruby 3.2; the libshadow fix lives in puppet-runtime. The reporter confirmed the official puppet-agent packages work.
2. If creating users with passwords fails on puppet 8 installed from your distros packages (Fedora hit this with an old libshadow on Ruby 3.2), switch to the official puppet-agent packages from Puppet instead of the distro build. The official packages carry the fixed libshadow. Distro puppet packages lag behind and can carry exactly this kind of native-extension mismatch.

When to use

You are seeing this: The reporter confirmed the official puppet-agent packages work. Use this skill when you run into "Setting user passwords fails on distro-packaged puppet 8".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: puppet 8.3.1. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/puppetlabs/puppet/issues/9320

In gh:puppetlabs/puppet#9320, the reporter ran into: Issue puppetlabs/puppet#9320 (closed, 6 comments): user { password value > Sensitive(...) } failed on Fedora 39 with puppet 8.3.1 installed from distro packages. The maintainer traced it to the distro shipping an old libshadow against Ruby 3.2; the libshadow fix lives in puppet-runtime. The reporter confirmed the official puppet-agent packages work. The verified answer was: If creating users with passwords fails on puppet 8 installed from your distros packages (Fedora hit this with an old libshadow on Ruby 3.2), switch to the official puppet-agent packages from Puppet instead of the distro build. The official packages carry the fixed libshadow. Distro puppet packages lag behind and can carry exactly this kind of native-extension mismatch. Source issue: https://github.com/puppetlabs/puppet/issues/9320