Open-source Puppet after Perforce: your options in 2026
Perforce moved new Puppet packages to a private repository with a commercial license above 25 nodes, and the community forked it as OpenVox. What changed, the four realistic paths for a Puppet fleet, and how to choose.
If your servers are configured with open-source Puppet, the ground moved under you in late 2024. Here is what changed and what you can do about it, without a sales pitch.
What changed#
In November 2024, Perforce (which bought Puppet in 2022) said new Puppet binaries and packages would move to a private, controlled repository from early 2025. Reporting on the change says use on more than 25 nodes needs a commercial license (DevClass). The source code stays under the Apache 2.0 license, but Perforce said public commits would slow down, and NC State noted no new releases in the public repositories as of July 2025 (NC State).
The community answered with OpenVox, a soft fork from Vox Pupuli that aims to stay compatible with Puppet (Le Monde Informatique). Perforce kept the Puppet name, which is why the fork has a different one.
Check Perforce's own current terms before you decide: the exact node limits and license wording are theirs to state.
Your four options#
- Pay Perforce. The least change. Right if Puppet Enterprise features matter to you and the price works at your node count.
- Move to OpenVox. Keep your manifests, modules and Hiera data, and swap the packages. Watch how the fork's testing and release cadence develop; it is young.
- Drop Puppet Server and run masterless.
puppet apply(or OpenVox's equivalent) runs your manifests on each machine with no central server. You then need something else to deliver the code, schedule runs and collect results. - Migrate over time to Ansible or Salt. The biggest effort, usually done one role at a time, starting with the machines you change most.
How to choose#
- Fewer than 25 nodes? Check whether the free terms cover you before changing anything.
- Heavy use of Puppet Enterprise reporting and RBAC? Option 1 or a careful migration.
- Mostly open-source Puppet with your own modules? OpenVox is the shortest step. Masterless is worth a look if Puppet Server is the part you dislike running.
- Already using Ansible somewhere? Fold Puppet roles into it as you touch them.
Where Gardience fits#
Gardience manages Windows and Linux fleets on the open-source Salt agent, and runs existing Ansible playbooks and Salt states over that same connection, with approvals and an audit trail. It does not run Puppet manifests today.
We are considering running Puppet or OpenVox manifests masterless over the same connection: your manifests from Git, apply on each machine, results and approvals in one place, at a flat price per fleet. If that would help your team, tell us what you run and on how many machines. It decides whether we build it.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare