Since we can't count on external debs to remain live (one was already taken down), we are packaging everything in a tarball and hosting it on s3.  I implemented a system inspired by S.Kendall, where we version a checksum file and determine if we need to pull a new one if the versioned checksum no longer matches the local file.