Wow, okay, I don't think it even actually USES open-uri anymore. [Take a look at this](https://github.com/nfagerlund/puppet/blob/48ec13771d90cbff053f72e8b6c06f2d00278fd9/lib/puppet/provider/package/pkgdmg.rb), it's what it looked like back in... 2006? What it's doing here is:

* Reset cached_source to the original source string if the curl fails.
* Use `open` (I assume that's Kernel.open), which is the thing open-uri overrides, to open cached_source -- if this isn't the downloaded file, it gets passed to open-uri, which does whatever magic it needs.
* Use `File.unlink(cached_source)` at the end of things

In THAT world, yeah, you provide a local path and Puppet will blow away your file, just like the thing says. But sometime in the intervening seven years, we switched to using File.open, which doesn't get finagled by open-uri, and deleting the temp directory we explicitly created instead of using File.unlink on cached_source. 

So now you MUST provide a curl-able URL, no exceptions, and we're loading open-uri and then doing nothing with it. If I didn't know better, I'd say that looks like the results of most of a decade of piecemeal modifications without a guiding plan.