Variants of this phrase can be found far beyond Scotland. It derives from a con trick, whereby an unsuspecting customer bought what they thought was a pig in a sealed bag ("poke"). On opening it, they would discover they had actually purchased a less valuable cat or dog.
The French equivalent is acheter un chat en poche (to buy a cat in a bag).
This same con trick is also the origin of another well-known expression: to let the cat out of the bag.