package installs outside module can install undesired version of PHP

Affected Puppet, Ruby, OS and module versions/distributions

Puppet: 7.23.0
Ruby: ruby 2.7.7p221 (2022-11-24 revision 168ec2b1e5) [x86_64-linux]
Distribution: Debian 11
Module version: 8.2.0
using sury sources

The issue:

Certain packages in Debian (such as simplesamlphp) have a dependency on "php". This resolves to php7.4 in Debian 11 and - currently - php8.2 with Sury sources added. Suppose the user specifically wants version 8.1, then installing it by means of setting php::globals::php_version to 8.1 does not result in litteral conflicts, but in 2 PHP versions of PHP ending up on the system, and the higher one of the two takes preference for the CLI binary.

Each php${version} package ("php7.4", "php8.1", "php8.2") has "php" in their "Provides" field to they all are capable of satisfying the dependency. So eg, if "php7.4" was previously installed, it satisfies the dependency;

How to reproduce (e.g Puppet code you use)

manifest:

    class { "php":
        manage_repos => true,
    }

    php::fpm::pool {"default":
    }

    package { "simplesamlphp":
        ensure  => present,
        # install simplesamlphp after configuring sury apt source and having a 
        # php version already installed so it doesn't pull php7.4 as a dependency
        require => Package["php8.1-fpm"],
    }

hiera:

  php::globals::php_version: '8.1'

What are you seeing

"php8.2" gets installed besides "php8.1-cli" and "php8.1-fpm"
"php8.2-cli" is installed as dependency
->

#  php -v
PHP 8.2.4 (cli) (built: Mar 16 2023 14:37:38) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.4, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.4, Copyright (c), by Zend Technologies

What behaviour did you expect instead

Preferably I'd like to see the "main" php version of a specific version installed. This will satisfy the dependencies of any other package that may depend on "php". I can see two options:

modify params.pp and set the default of '$common_package_names' to "php${php::globals::php_version}" for Debian family OS's (common_package_names is set in a private class and it can't be overridden)
use the alternatives system as suggested in #652 and set php to /usr/bin/php\<version> explicitly

voxpupuli / puppet-php