package installs outside module can install undesired version of PHP

[FrankVanDamme]

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 7.23.0
• Ruby: ruby 2.7.7p221 (2022-11-24 revision 168ec2b1e5) [x86_64-linux]
• Distribution: Debian 11
• Module version: 8.2.0
• using sury sources

The issue:

Certain packages in Debian (such as simplesamlphp) have a dependency on "php". This resolves to php7.4 in Debian 11 and - currently - php8.2 with Sury sources added. Suppose the user specifically wants version 8.1, then installing it by means of setting php::globals::php_version to 8.1 does not result in litteral conflicts, but in 2 PHP versions of PHP ending up on the system, and the higher one of the two takes preference for the CLI binary.

Each php${version} package ("php7.4", "php8.1", "php8.2") has "php" in their "Provides" field to they all are capable of satisfying the dependency. So eg, if "php7.4" was previously installed, it satisfies the dependency;

How to reproduce (e.g Puppet code you use)

manifest:

    class { "php":
        manage_repos => true,
    }
 
    php::fpm::pool {"default":
    }
 
    package { "simplesamlphp":
        ensure  => present,
        # install simplesamlphp after configuring sury apt source and having a 
        # php version already installed so it doesn't pull php7.4 as a dependency
        require => Package["php8.1-fpm"],
    }

hiera:

  php::globals::php_version: '8.1'

What are you seeing

• "php8.2" gets installed besides "php8.1-cli" and "php8.1-fpm"
• "php8.2-cli" is installed as dependency
• ->

#  php -v
PHP 8.2.4 (cli) (built: Mar 16 2023 14:37:38) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.4, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.4, Copyright (c), by Zend Technologies

What behaviour did you expect instead

Preferably I'd like to see the "main" php version of a specific version installed. This will satisfy the dependencies of any other package that may depend on "php". I can see two options:

• modify params.pp and set the default of '$common_package_names' to "php${php::globals::php_version}" for Debian family OS's (common_package_names is set in a private class and it can't be overridden)
• use the alternatives system as suggested in Add switch to run update-alternatives to set the managed PHP version as default #652 and set php to /usr/bin/php<version> explicitly

Output log

Any additional information you'd like to impart

[abctaylor]

This is definitely an issue and is super annoying!