Change package ensure to be configurable

Currently all packages are ensured latest, which
can be undesirable for stable platforms. This patch
makes the ensure configurable with a new parameter.