Especially for packages with the rpm provider, using ensure=>latest results in the rpm being downloaded on every puppet run.

What is the downside to just removing this from any manifest item - do we just grep and remove? Or is there a replacement that has the same affect but without the downside?

I think we'd need ensure => "X.Y.Z", although maybe ensure => present would work...