In the last episode (Dec 19), Peter Bortas @ Pike developers forum said:

What function does CVSROOT/val-tags fill? I'm trying to check out the c7_4_10 tag but get:

% cvs up -r v7_4_10 ..ter/hack/Pike/7.4 cvs [server aborted]: cannot write /pike/data/cvsroot/CVSROOT/val-tags: Permission denied

It's a cache of known tags; the idea is that it gets updated when anyone creates a tag, and CVS will check that file when anyone does a -r TAGNAME operation. It doesn't do anything but cause trouble as far as I know (since it doesn't really speed anything up), and was never fully implemented in the first place. The fix for your problem is to make /pike/data/cvsroot/CVSROOT/val-tags world-writeable in the CVS repository. CVS v1.11.1 and newer ignore write errors to val-tags, I believe.

I usually work around it by finding the date the tag was layed down, and using cvs -D instead of -r.