It is in libcrypt.a and libmd.a. This means a build can fail with duplicate symbols depending on the order these libraries are used. It currently causes rescue to fail to build with lld.
This was fixed in r301168 but, it does not fail with the linker included in base.
Thanks!