Puppet open source change: OpenVox, a license, or a move
Perforce moved Puppet's packages to a private repository in 2025, with a commercial license needed past 25 nodes, and the community forked it as OpenVox. The three paths for Puppet shops, especially with Windows.
In late 2024 Perforce announced that Puppet's open-source builds would move to a private repository, and in 2025 they did: the binaries and packages most Puppet users installed now come from Perforce's own repository, and use beyond 25 nodes needs a commercial license (DevClass). The community answered with a fork, OpenVox, to keep public builds going (The New Stack).
If you run Puppet, you now have three choices. None is wrong; they fit different shops.
Path 1: buy Puppet#
If Puppet works for you, your team knows it, and the license cost fits, this is the least disruptive path. You get a vendor, supported packages, and Puppet Enterprise's console.
Path 2: move to OpenVox#
OpenVox aims to be a drop-in, community-run continuation of open-source Puppet. You keep your manifests and modules and your skills. The questions to ask are the usual ones for a young fork: release cadence, security response, and who you call when it breaks at 2 a.m.
Path 3: use the moment to change tools#
A license change is also a natural moment to fix anything that bothered you anyway. For shops with Windows, the usual candidates are agent runs on a fixed interval rather than in reaction to events, slow feedback when you need a change everywhere now, and Windows support that lags Linux.
Salt is the natural candidate in that case. It is agent-based like Puppet (so the model is familiar), but its agents keep a live connection to the master, so jobs run across the fleet in seconds, and machines report events (a stopped service, a full disk) as they happen. Salt states are declarative YAML, closer to Puppet manifests in spirit than to procedural playbooks.
Gardience makes that move practical for teams that do not want to become Salt experts first:
- a supported console on open-source Salt for Windows and Linux;
- patching, a scored STIG/CIS-aligned baseline, drift repair, and event-driven automation;
- forms, a command search in plain words, and an AI assistant that writes the Salt for you and waits for approval;
- your existing Ansible playbooks run as they are over the Salt connection, which helps if part of your team already lives in Ansible;
- built on open-source Salt, so your agents and states are standard Salt and keep running without us if you ever leave.
How to decide#
| You want | Pick |
|---|---|
| Minimum change, budget available | Puppet with a license |
| Minimum change, community-run | OpenVox |
| Faster feedback, first-class Windows, events, approvals, and audit | Salt, with a console such as Gardience |
Questions#
Is open-source Puppet still free?#
The source code remains available, but since 2025 Perforce's packages come from a private repository and use beyond 25 nodes needs a commercial license. OpenVox provides community builds.
Can I convert Puppet manifests to Salt states automatically?#
Not reliably. Plan a staged move: start with new machines and the highest-value configurations, and keep Puppet running for the rest until each area is moved.
Does Salt manage Windows as well as Linux?#
Yes. The Salt minion runs natively on Windows, and Gardience adds Windows patching and a baseline on top.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare