It seems like there are some bad checksums in the updates repodata for the x86_64 5.2 tree (the onlyone I've checked). Trying to update a freshly installed (and fairly minimal, so I don't know exactly how many packages are affected) system I get:
http://$myserver/yum/updates/centos-5/x86_64/RPMS/selinux-policy-targeted-2....: [Errno -1] Package does not match intended download http://$myserver/yum/updates/centos-5/x86_64/RPMS/yum-3.2.8-9.el5.centos.2.1...: [Errno -1] Package does not match intended download http://$myserver/yum/updates/centos-5/x86_64/RPMS/selinux-policy-2.4.6-137.1...: [Errno -1] Package does not match intended download
And, indeed, checking the sha1sums of those packages against the values in repodata/primary.xml.gz shows that they differ. I verified this against multiple mirrors. Running 'createrepo' fixes the issue.
It seems like there's already a hint of this as Issue 2997.
Thanks.