cvs-1.11-2.src.rpm does not build because the cvs-1.11-security.patch fails to apply. I'm using rpm-3.0.5-9.6x and patch-2.5-10.
The problem is that the cvs-1.11-security.patch is has DOS line-end
terminators. Converting to UNIX line-ends does the trick.
This will be fixed in cvs-1.11-3. Updating to patch 2.5.4 should also work
around this. Thanks!