patches welcome 🙂

@steveax which version of

hiera-eyaml

went out with 2025.11.2? I suspect decryption is the actual problem as

eyaml createkeys

and

eyaml encrypt

are commonly run under CRuby.

while we ship hiera-eyaml in the runtime, it's the puppetserver user installed module that's failing here

E.g. github.com/voxpupuli/hiera-eyaml/blob/…/pkcs7.rb#…

Hmmm, that doesn't match the failure case I saw - decrypt seemed fine,

3.4.0

is what ships in the runtime on

2025.11.2

but that wasn't in play in my testing. Would be great if you could give that PR a poking at

Yeah. I'm looking at it. Empty issuer is a problem, but I want to make sure we're solving the actual cause of the failures --- because running

eyaml createkeys

under JRuby is just odd. I don't think the

eyaml

bin stub is even set up to execute under

puppetsever ruby

--- unless PE is doing something different in

puppet-runtime

.

I tested pretty hard in a PE install, but less so in a standalone puppetserver

A stack trace from the user operation that is failing would help.

did the user just do a

lookup()

of a eyaml value or something else?

this is from my repo:

Exactly. If it's

lookup()

, then we're likely chasing a red herring in regard to

Issuer:

That wasn't confirmed to match @vchepkov’s failure though.

true

do they have some magic to check if keys exist and if not, call a function to create them?

should we move this conversation to the PR?

Ah. A custom function that called directly into

hiera-eyaml

as a library would make sense.

yeah

😉

if it would be an exec resource or type/provider, it would just work 😄

In the middle of the upgrade peadm failed, because puppetserver wasn't able decrypt/compile catalog I patched my fork of peadm here https://github.com/vchepkov/puppetlabs-peadm/commit/f2c3aa50f679eac48127056c4aad9500865cea4a

Ok, so that is a failure in

decrypt

and not

create_keys

.

yep

Which should be fixed starting with

hiera-eyaml

4.1.0

traveling, will check after vacation:)

I give you bonus points for creative solution

It's a hack and I know it :)

on the decrypt side,

puppetserver gem install hiera-eyaml -v 5.0.1

should take care of that I think?

Should do. That's what OpenVox Server is shipping with, and I wasn't able to re-produce a decrypt failure.