@taavi has [[https://wikis.world/@taavi/114506697406506075|mentioned this before]] as a known issue. The Puppet ENC api normalizes YAML input by parsing it into Python native data structures with `yaml.safe_load` and then creating a canonical stored form by `yaml.safe_dump` of that native data. This round trip from YAML to Python and then back to YAML can change the quoting of strings and various other minor structural differences in the YAML that do not change the semantic content of the configuration, but do create dirty diffs when comparing input to output.
```COUNTEREXAMPLE
╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to module.haproxy.cloudvps_puppet_prefix.haproxy,
│ provider "provider[\"terraform.wmcloud.org/registry/cloudvps\"]" produced an
│ unexpected new value: .hiera: was
│ cty.StringVal("\"profile::zuul::haproxy::kubernetes_hosts\":\n-
│ \"172.16.10.149\"\n"), but now
│ cty.StringVal("profile::zuul::haproxy::kubernetes_hosts:\n -
│ 172.16.10.149\n").
│
│ This is a bug in the provider, which should be reported in the provider's own
│ issue tracker.
╵
```
In this particular input case the Tofu side is using Tofu's `yamlencode` function to produce Tofu cannonical YAML. As the slightly obfuscated diff here shows this form is more aggressive with quoting strings and does not indent list elements under a hash key. There are likely more small differences that would be revealed by a more complex input.
Can we find a way for the golang to produce the same canonicalized form as Python does so that we can preprocess the input to Tofu and eliminate (or at least greatly reduce) round trip dirty diffs?