Okay on further investigation, it appears cooking is going to the 3.0 repo (evidenced by 2.6.30.6 kernel), even though

/etc/slitaz-release = cooking

and even with

tazpkg set-release cooking

My guess would be some file that belongs in the cooking repo was overwritten with something from 3.0.

Found problem:

packages.txt

is missing from

http://mirror.slitaz.org/packages/cooking/

so tazpkg gets it from

http://download.tuxfamily.org/slitaz/packages/cooking/

which has an out-of-date packages.txt.

so on further investigation it appears that the main problem file is

packages.list

which is missing from most/all of the cooking repo mirrors but is present and dated on

download.tuxfamily.org

The same appears to be true for

pakages.md5

Looking at the tazpkg help, there doesn't seem to be an option to block a particular mirror. A

block-mirror

command would be useful. (Yeah iptables could be used, but....)