Busybox contains two bundled implementations of MD5 and needs to follow the related packaging guidelines: https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries 1) libbb/hash_md5_sha.c is an implementation by Ulrich Drepper, which is not known yet at https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#cite_note-0 For a different implementation by Ulrich, see https://fedorahosted.org/fpc/ticket/130 where an exception and a name for it has been requested. 2) libbb/hash_md5prime.c is "not used by busybox right now" according to that file. It's based on an implementation by RSA, but has been edited [to an extend I haven't analyzed]. No action is needed for this implementation yet. However, if you delete that source file during %prep, it won't be built with accidentally. ;)
Here's the FPC's resolution since I haven't seen anyone else filing a ticket in their tracker: https://fedorahosted.org/fpc/ticket/367
I propose to close it as WONTFIX. Busybox is meant to be used (among other scenarios) in emergency repairs. To this end, it's useful to have it statically linked, so that we don't depend on on NSS libs (or any other libs) to be present on the system.
Why would you propose that? Just follow https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#Packages_granted_exceptions and add "Provides: bundled(md5-drepper2)" to the package. See footnode 2.
Fix committed to Rawhide. No build request submitted, however.