Puppet class to pull in a package. Ubuntu-friendly, but non-toxic to other UNIX.

package.pp

class NAMESPACE::package (
  $package    = $NAMESPACE::package::params::package,
  $repository = $NAMESPACE::package::params::repository,
  $repokey    = $NAMESPACE::package::params::repokey,
  $reponame   = $NAMESPACE::package::params::reponame,
  $keyserver  = $NAMESPACE::package::params::keyserver
) inherits NAMESPACE::package::params {
  package { $package:
    ensure  => installed,
  }

  if ($repository and $::operatingsystem == 'Ubuntu') {
    # friendly unique titles
    $_repokey = "get ${repokey} from ${keyserver}"
    $_update  = "apt-get update for ${reponame}"
    $_source  = "/etc/apt/sources.list.d/${reponame}.list"

    # fetch the key
    exec { $_repokey:
      path    => '/bin:/usr/bin',
      unless  => "apt-key list | grep '${repokey}'",
      command => "apt-key adv --keyserver ${keyserver} --recv-keys ${repokey}",
    }

    # add the source
    file { $_source:
      ensure  => present,
      content => "${repository}\n",
    }

    # apt-get update if it hasn't been done since adding the source
    $find_newer_lists = "find /var/lib/apt/lists -type f -cnewer ${_source}"
    exec { $_update:
      path    => '/usr/bin',
      command => 'apt-get update',
      onlyif  => "test -z \"\$(${find_newer_lists})\"",
      timeout => 3600,
      require => [Exec[$_repokey], File[$_source]],
    }

    # tell the package to depend on the update check
    Package[$package] {
      require +> Exec[$_update],
    }
  }
}

That's where I'm headed, yes, though it occurs to me that it might be better off as a definition…

You can more easily add sources with the puppetlabs apt module:
https://github.com/puppetlabs/puppetlabs-apt