puppetlabs/puppetlabs-firewall — pull request #100 by mrwacky42 (2012-11-16 20:49:52+00:00)
Title: (#16004) array_matching is contraindicated.

With ":array_matching =>:all", uid/gid rules are reloaded with every
Puppet run. This is ugly and annoying, and arguably wrong.