Hi !
We are packaging RoundCube for Debian and we have found that des.inc does not have any license. This makes RoundCube non-free. I have contacted the author of des.inc (Paul Tero) but I did not get an answer.
To package it in Debian, we have applied the attached patch that uses libmcrypt instead of des.inc. des.inc claims to use Triple-DES but it seems that this is not the case. We don't get the same results with libmcrypt. I have tried with OpenSSL as well and the result does not match either (but it matches the result of libmcrypt). This is another argument to use libmcrypt instead of des.inc.
The incompatibility means that users need to disconnect and reconnect after upgrade. This is a pretty minor issue. Please, could you apply this patch on RoundCube as well ?