http://bugs.winehq.org/show_bug.cgi?id=21206
--- Comment #5 from Dan Kegel dank@kegel.com 2010-01-10 01:35:44 --- I think I have a workaround, though, which I'll bake into winetricks until we've fixed the bug. Here 'tis:
Use an old setup.exe (the one I just uploaded at http://kegel.com/cygwin/1.5/setup.exe will do) Invoke it with the -X parameter to turn of signature checking, and use the URL ftp://www.fruitbat.org/pub/cygwin/circa/2009/09/08/111037 for the repository. (-X is needed because the archive at fruitbat.org doesn't have the .sig files.)
That doesn't behave perfectly, but it does seem to let me limp along.