diff --git a/spec/defines/source_spec.rb b/spec/defines/source_spec.rb
index 9c619439c0..2d5b45f9d6 100644
--- a/spec/defines/source_spec.rb
+++ b/spec/defines/source_spec.rb
@@ -435,31 +435,51 @@
       end
 
       it { is_expected.to contain_apt__setting("sources-#{title}").with_notify_update(true) }
+      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(<<~SOURCE) }
+        # This file is managed by Puppet. DO NOT EDIT.
+        # my_source
+        Enabled: yes
+        Types: deb
+        URIs: http://debian.mirror.iweb.ca/debian/
+        Suites: stretch
+        Components: main contrib non-free
+      SOURCE
     end
 
     context 'complex deb822 source' do
       let :params do
         super().merge(
           {
+            enabled: false,
             types: ['deb', 'deb-src'],
             location: ['http://fr.debian.org/debian', 'http://de.debian.org/debian'],
             release: ['stable', 'stable-updates', 'stable-backports'],
             repos: ['main', 'contrib', 'non-free'],
             architecture: ['amd64', 'i386'],
             allow_unsigned: true,
-            notify_update: false
+            allow_insecure: true,
+            notify_update: false,
+            check_valid_until: false,
+            keyring: '/foo'
           },
         )
       end
 
       it { is_expected.to contain_apt__setting("sources-#{title}").with_notify_update(false) }
-      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(%r{Enabled: yes}) }
-      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(%r{Types: deb deb-src}) }
-      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(%r{URIs: http://fr.debian.org/debian http://de.debian.org/debian}) }
-      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(%r{Suites: stable stable-updates stable-backports}) }
-      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(%r{Components: main contrib non-free}) }
-      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(%r{Architectures: amd64 i386}) }
-      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(%r{Trusted: yes}) }
+      it { is_expected.to contain_apt__setting("sources-#{title}").with_content(<<~SOURCE) }
+        # This file is managed by Puppet. DO NOT EDIT.
+        # my_source
+        Enabled: no
+        Types: deb deb-src
+        URIs: http://fr.debian.org/debian http://de.debian.org/debian
+        Suites: stable stable-updates stable-backports
+        Components: main contrib non-free
+        Architectures: amd64 i386
+        Allow-Insecure: yes
+        Trusted: yes
+        Check-Valid-Until: no
+        Signed-By: /foo
+      SOURCE
     end
 
     context '.list backwards compatibility' do
diff --git a/templates/source_deb822.epp b/templates/source_deb822.epp
index 10802b05d5..248833a706 100644
--- a/templates/source_deb822.epp
+++ b/templates/source_deb822.epp
@@ -1,23 +1,24 @@
-<% | String $comment,
+<%- |
+  String[1] $comment,
   Enum['yes','no'] $enabled,
-  Array[String] $types,
-  Array[String] $uris,
-  Array[String] $suites,
-  Array[String] $components,
-  Optional[Array] $architectures = undef,
+  Array[String[1]] $types,
+  Array[String[1]] $uris,
+  Array[String[1]] $suites,
+  Array[String[1]] $components,
+  Optional[Array[String[1]]] $architectures = undef,
   Optional[Enum['yes','no']] $allow_insecure = undef,
   Optional[Enum['yes','no']] $repo_trusted = undef,
   Optional[Enum['yes','no']] $check_valid_until = undef,
-  Optional[Variant[Stdlib::AbsolutePath,Array[String]]] $signed_by = undef,
+  Optional[Variant[Stdlib::AbsolutePath,Array[String[1]]]] $signed_by = undef,
 | -%>
 # <%= $comment %>
 Enabled: <%= $enabled %>
-Types: <% $types.each |String $type| { -%> <%= $type %> <% } %>
-URIs: <% $uris.each | String $uri | { -%> <%= $uri %> <% } %>
-Suites: <% $suites.each | String $suite | { -%> <%= $suite %> <% } %>
-Components: <% $components.each | String $component | { -%> <%= $component %> <% } %>
+Types: <%= $types.join(' ') %>
+URIs: <%= $uris.join(' ') %>
+Suites: <%= $suites.join(' ') %>
+Components: <%= $components.join(' ') %>
 <% if $architectures { -%>
-Architectures:<% $architectures.each | String $arch | { %> <%= $arch %><% } %>
+Architectures: <%= $architectures.join(' ') %>
 <%- } -%>
 <% if $allow_insecure { -%>
 Allow-Insecure: <%= $allow_insecure %>
@@ -29,8 +30,5 @@ Trusted: <%= $repo_trusted %>
 Check-Valid-Until: <%= $check_valid_until %>
 <% } -%>
 <% if $signed_by { -%>
-Signed-By: <% if type($signed_by) =~ Type[Array] { -%><%- $signed_by.each |String $keyring| { -%><%= $keyring %> <% } -%>
-<%- } -%>
-<%- elsif type($signed_by) =~ Type[String] { -%>
-<%= $signed_by -%>
-<%- }} %>
+Signed-By: <%= [$signed_by].flatten.join(' ') %>
+<% } -%>