The apt package provider does not mark packages as manual. This means that if a package gets removed, some packages may get marked for deletion if nothing depends on them any longer - even though they should be installed according to Puppet.
Puppet purges a package depending on `ethtool`.
Nothing depends on `ethtool` any longer, so it gets marked for deletion, but is still installed.
Puppet processes 'package
' and does nothing, since it's already installed
If something or someone then runs `apt-get -y autoremove` the package ethtool will then be removed (in my case puppet does this later in the run).
This specific example makes it impossible for Puppet to rectify it in a later run, since the ethtool package is required to bring up the network interface.