Who maintains RPM? (2011 edition)

A deb package is technically gluing of two tarballs: "control" and "data". This gluing is done using an ar archive as ar is a very light-weight archive that adds very little overhead. Here is the content of that archive for some random package:

$ ar tv $PACKAGE.deb
rw-r--r-- 0/0 4 Apr 17 06:55 2011 debian-binary
rw-r--r-- 0/0 1975 Apr 17 06:55 2011 control.tar.gz
rw-r--r-- 0/0 73363 Apr 17 06:55 2011 data.tar.gz

$ ar p $PACKAGE.deb control.tar.gz | tar tzf -
./
./control
./md5sums

$ ar p $PACKAGE.deb control.tar.gz | tar xOzf - ./control
Package: cdbs
Version: 0.4.93
Architecture: all
Maintainer: CDBS Hackers <build-common-hackers@lists.alioth.debian.org>
Installed-Size: 376
Depends: debhelper (>= 5.0.30)
Recommends: autotools-dev
Suggests: devscripts
Section: devel
Priority: optional
Description: common build system for Debian packages
This package contains the Common Debian Build System, an abstract build
system based on Makefile inheritance which is completely extensible and
overridable. In other words, CDBS provides a sane set of default rules
upon which packages can build; any or all rules may be overridden as
needed.

The rough equivalents of those in an rpm package is:

data.tar.gz is the cpio archive you mentioned. The metadata and the gluing in a deb package are done in a way that is at least accessible through standard shell tools. It was originally done with some custom dictionary and custom gluing as in RPM, but later on they preferred to use a more standard method.

I'm sure there are some merits to the rpm format. It's just that your criticism is wrong.