Recently, in the "makepasswd" review another bundled MD5 implementation has been discovered. This time it's the original reference implementation by RSA as found in the RFC (files global.h, md5.h, md5.c):

https://bugzilla.redhat.com/1012391#c22

If makepasswd upstream replaces it with one of the already tracked implementations, no new copylib exception from the FPC is needed. Is that assumption correct? (-> comments 25 and 26 in the ticket)
In that case, no new 'bundled(md5-$IMPLEMENTATION)' name will be needed either, but the package could provide the appropriate one from the existing list.

[...]

Surprisingly, package "libsidplayfp" includes an ancient C++-ified implementation of MD5. Originally, it has not been included with its predecessor and has been merged from external tools/libs (such as libsidutils). It's based on the original implementation from L. Peter Deutsch but wrapped into a C++ class interface. The resulting code has been used and reused since 1999/2000:

http://sourceforge.net/p/sidplay-residfp/code/HEAD/tree/branches/libsidplayfp-1.1/utils/MD5/

As I understand [1] and since the implementation is based on 'bundled(md5-deutsch)', no new exception is needed, but a new name for tracking that implementation will be needed for the Provides.

[1] https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#cite_note-0