Recently we were really wondering why we had an unexpected hhvm on a gerrit server.
gerrit2001 had an installed and running hhvm process while nothing in the gerrit puppet
role applied on this server references hhvm in any way.
It turned out the explanation is scap.
We started to deploy Gerrit with scap instead of the Debian package and also gerrit2001 got recently
upgraded to stretch while cobalt (prod gerrit) is still on jessie.
The issue is that the scap package has the following dependencies in the debian/control file:
php5-cli | hhvm
"|" as in OR.
And on stretch there is no php5-cli, only php7.0-cli... so the result is that hhvm gets pulled in as the only alternative.
And a host like gerrit2001 which uses Apache and PHP7 also gets a surprise hhvm.
The scap package dependencies should be updated and it should be rebuilt to reflect this.. and also accept PHP7 as an alternative.
See the "Depends" line on https://phabricator.wikimedia.org/source/scap/browse//debian/control