There are occasional cases where the puppet head on the prod puppetmasters (puppetmaster1001.eqiad.wmnet et al) is not the same sha1 as the head in the operations/puppet repo hosted on Gerrit.
Our VM-hosted puppetmasters just blindly pull down the latest repo from Gerrit. So occasionally we'll get out of sync from prod.
@fgiunchedi (and others) suggest that we have the puppet-merge script on prod publish the latest sha1 to etcd, which can then be made available via URL on noc.wm.o. Then our existing update cron on VM puppetmasters can grab the sha1 from a URL and sync to that.
I don't immediately know how to do the publishing side of this, but I like the idea!