I've updated the CentOS part of
https://wiki.mozilla.org/ReleaseEngineering/PuppetAgain/Packages a bit.
The major change is that use of the releng and releng-updates repositories is now deprecated. Instead, best practice dictates very narrowly-purposed repos. For example, upgrading OpenSSL should involve a new OpenSSL repository containing only the new packages and any unsatisfied dependencies.
Among other advantages, this vastly narrows the collateral damage from repository modifications: hosts that aren't even looking at the repository you're mucking with are 100% guaranteed to be untouched, and it's much easier to set up a 10MB temporary test repository to experiment with a modification, and to back up the old copy temporarily while deploying.
I'll make the same modifications in principle for Ubunutu. This leaves untouched the open questions about regular repo updates or a way for different organizations to update at the same time and share the results. I'm still thinking about those things :)
Dustin