Deferred file content leaks secrets into puppet agent output

The problem

a file resource using stdlib::deferrableepp rendered the new secret in plain text in the agent output whenever it changed. The reporter found that setting preprocessdeferred = true in puppet.conf made agent 8.5 behave like 7.x and stopped the leak. A plain Sensitive value on the file resource redacts fine; the leak is specific to deferred values.

The fix

If secrets show up in clear text in puppet agent output when a deferred file resource changes, set preprocessdeferred = true in puppet.conf. In agent 8 the default flipped to false, so deferred values get rendered into the diff; turning preprocessing back on restores the 7.x behavior where Sensitive values stay redacted. The stdlib deferrableepp path is the one that leaks, so check that setting first before auditing your manifests.

In gh:puppetlabs/puppet#9384 (https://github.com/puppetlabs/puppet/issues/9384), the reporter ran into this: a file resource using stdlib::deferrableepp rendered the new secret in plain text in the agent output whenever it changed. The reporter found that setting preprocessdeferred = true in puppet.conf made agent 8.5 behave like 7.x and stopped the leak. A plain Sensitive value on the file resource redacts fine; the leak is specific to deferred values. The verified resolution: If secrets show up in clear text in puppet agent output when a deferred file resource changes, set preprocessdeferred = true in puppet.conf. In agent 8 the default flipped to false, so deferred values get rendered into the diff; turning preprocessing back on restores the 7.x behavior where Sensitive values stay redacted. The stdlib deferrableepp path is the one that leaks, so check that setting first before auditing your manifests.