Hey, I think we might have found a bug in the mirror crawler where it did not do the repomd sha256sum check if a mirror is checked via FTP. I think the crawler might still need a good bit of cleanup apart from this, but here is an initial attempt at a patch to fix this:
http://ricky.fedorapeople.org/mirrormanager/0001-Check-sha256sum-of-repomd.x...
I did some testing of this against fedora.bu.edu on bapp1 and it seemed to mark the F10/F11 repodata directories outdated as expected.
Given the mirror issues that we've been havin recently, it might be worth considering live patching this until the next mirrormanager release.
Thanks, Ricky