libetpan contains md5.c and md5.h from Cyrus SASL. They are licensed under RSA-MD, which contains an advertisement clause and is therefore incompatible with GNU GPL. Major libetpan users are licensed under GPL, e.g. Claws Mail. The incompatibility makes distributing binaries that are covered by both licenses problematic.

Please consider replacing the files. If you want to stick with the Cyrus SASL HMAC-MD5 implementation, please consider importing a later (relicensed) version that uses OpenSSL as MD5 backend. I do not see HMAC-MD5 being used. APOP is the only user of regular MD5 calculations, so it should be possible to replace the MD5 entirely with some other implementation, e.g. the Openwall one.