ensure => latest, I have systems which do not need all of the same packages.
ensure => latest install the packages or only update if they already are present? If they are not present, I do not want them installed. This is to keep existing packages up to date with latest patches. I haven't tried it for fear of installing a package on a system which doesn't need it.