@sstrato this isn't idempotent.  and probably shouldn't be run here at all. it forces an apt-get update to run every converge.