Puppet can't downgrade with ensure installed/latest

I'm using the following in my Puppet manifest:

$packages = [
  '2klic-gateway=2.10.5',
]

package { $packages: ensure => latest }

Also tried using installed instead of latest. But I get back the following error:

Error: Could not update: Execution of '/usr/bin/apt-get q -y -o DPkg::Options::=-force-confold install 2klic-gateway=2.10.5' returned 100: Reading package lists...
Building dependency tree...
Reading state information...
The following package was automatically installed and is no longer required:
2klic-updates
Use 'apt-get autoremove' to remove it.
The following packages will be DOWNGRADED:
2klic-gateway
0 upgraded, 0 newly installed, 1 downgraded, 0 to remove and 5 not upgraded.
Need to get 22.0 MB of archives.
After this operation, 312 kB disk space will be freed.
E: There are problems and -y was used without --force-yes
Error: /Stage[main]/Main/Node[default]/Package[2klic-gateway=2.10.5]/ensure: change from purged to latest failed: Could not update: Execution of '/usr/bin/apt-get q -y -o DPkg::Options::=-force-confold install 2klic-gateway=2.10.5' returned 100: Reading package lists...
Building dependency tree...
Reading state information...
The following package was automatically installed and is no longer required:
2klic-updates
Use 'apt-get autoremove' to remove it.
The following packages will be DOWNGRADED:
2klic-gateway
0 upgraded, 0 newly installed, 1 downgraded, 0 to remove and 5 not upgraded.
Need to get 22.0 MB of archives.
After this operation, 312 kB disk space will be freed.
E: There are problems and -y was used without --force-yes

If I manually ssh into the node I can use apt-get install 2klic-gateway=2.10.5 and it works. I can also remove the program and then run puppet and the manifest works fine. But as soon as I add the -y flag I get:

E: There are problems and -y was used without --force-yes

Solution

I was able to fix this by telling Puppet to use --force-yes when installing like this:

package { 
  $packages: ensure => installed,
  install_options   => ['--force-yes'],
}

I will leave this question open as, this answer is not safe.

--force-yes
       Force yes; this is a dangerous option that will cause apt to continue
       without prompting if it is doing something potentially harmful. It
       should not be used except in very special situations. Using force-yes
       can potentially destroy your system! Configuration Item:
       APT::Get::force-yes. This is deprecated and replaced by
       --allow-downgrades, --allow-remove-essential,
       --allow-change-held-packages in 1.1.

Option #2

If your nodes are running a system that have apt version 1.1 or higher you can use --allow-downgrades instead of --force-yes. This is a safer option though still not recommended in the man pages:

 --allow-downgrades
       This is a dangerous option that will cause apt to continue without
       prompting if it is doing downgrades. It should not be used except
       in very special situations. Using it can potentially destroy your
       system! Configuration Item: APT::Get::allow-downgrades. Introduced
       in APT 1.1.

Unfortunately in my situation my nodes are running apt version 1, so this would require first upgrading the version of apt.