I'm trying to build the simple Puppet recipe as below:

package { 'openjdk-7-jre-headless' :  ensure => installed, }
package { 'tomcat7-common' :          ensure => installed, }
package { 'tomcat7' :                 ensure => installed, require  => Package['tomcat7-common'],}
package { 'tomcat7-admin' :           ensure => installed, require  => Package['tomcat7-common'], }

However when run sudo puppet apply -v tomcat7.pp, I've still these errors:

err: /Stage[main]//Package[tomcat7-common]/ensure: change from purged to present failed: Execution of '/usr/bin/apt-get -q -y -o DPkg::Options::=--force-confold install tomcat7-common' returned 100: Reading package lists...

The following packages have unmet dependencies: tomcat7-common :

Depends: libtomcat7-java (>= 7.0.28-4+deb7u1) but it is not going to be installed

E: Unable to correct problems, you have held broken packages.

And each time I'm adding new packages, my file is growing making it difficult to read. Do I really need to specify all Tomcat dependencies manually? Or is there any simpler way of doing it?

  • Why not use the puppetlabs/tomcat and puppetlabs/java modules?
    – jordanm
    Mar 29, 2015 at 15:05
  • Thanks. But it'll be another dependency (I've already puppetlabs-apache, puppetlabs-mysql, etc.). Do you think it'll be the easiest way? Does it mean that for each package to be installed, it's better to install module, instead of trying to write recipe with dependencies manually?
    – kenorb
    Mar 29, 2015 at 15:08
  • 1
    You shouldn't have to write the apt dependencies manually anyways. Something in your apt is probably broken (or you need an apt-get upgrade). The number of external puppet dependencies really shouldn't matter. You should use something like r10k or puppet-librarian.
    – jordanm
    Mar 29, 2015 at 15:11
  • Did apt-get upgrade and apt-get update, it's still the same.
    – kenorb
    Mar 29, 2015 at 15:14
  • 1
    You will have to work it out manually. Something in the install chain in likely broken. Unfortunately, apt doesn't do a good job of reporting where the actual problem is.
    – jordanm
    Mar 29, 2015 at 15:15

1 Answer 1


Puppet should deal with dependencies automatically, so the simple manifest which should work is:

package { [ 'tomcat7', 'tomcat7-admin' ]: ensure => installed, }

However depending on the problems (like having old Tomcat installed or broken dependencies), these problems should be resolved manually. For example by manually running apt-get tomcat7 and checking what's blocking it (e.g. 'The following packages will be REMOVED' section).

Using Puppet, there is the following workaround:

package { "tomcat7":
  ensure  => latest,
  require  => Exec['apt-get update'],

Or by defining absent (or purged), such as:

package { [ 'tomcat6', 'tomcat6-common', 'libtomcat6-java','solr-tomcat' ]:
  ensure => absent

to ensure that conflicting packages are not installed on the machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .