## TL;DR
Every rebuild re-hashes, so a naive SBOM diff reports 200 changes where nothing actually changed. Diff on name plus version (ignoring hashes), or use an SBOM diff tool that treats hash-only changes as noise.

## Error
```text
agent's SBOM diff flagged 200 changes  -  all were hash-only and the security review was noise
```

## Steps
1. Confirm the noise: check whether the flagged entries differ only in hashes with names and versions unchanged.
   Expected output: The diff is hash churn, not real change.
2. Re-run the comparison keyed on package name and version only, treating hash differences as expected.
   Expected output: The diff shrinks to the real changes, possibly zero.
3. Switch the review tooling to an SBOM-aware diff that separates content changes from hash churn.
   Expected output: Future diffs report signal by default.
4. If hashes must be reviewed (tamper detection), separate that into its own check rather than the change-review diff.
   Expected output: Two clear signals: what changed, and whether artifacts match.
5. Tell the agent to summarize SBOM diffs by name and version, calling out hash-only entries as noise.
   Expected output: Reviews stay short and honest.

## When to use
- An SBOM diff is dominated by hash-only changes
- Security review is drowning in noise from rebuilds
- You are choosing SBOM diff tooling

## When not to use
- Diffs with real version changes; review those
- Hash mismatches against a trusted baseline; that is tamper detection
- First-time SBOM reviews; everything is new and that is fine

### Variant phrasings
#### SBOM diff shows hundreds of hash-only changes
#### ignore hash churn in SBOM comparison
#### SBOM diff noise from rebuilds

## Why it happens
Hashes cover the exact artifact bytes, and rebuilds, repackaging, or registry mirrors change bytes without changing the software. A byte-level diff therefore reports change on every rebuild, burying the version changes the review is actually for.

## Edge cases
- A hash change with the same version can still mean a compromised artifact; keep tamper detection as a separate check.
- Reproducible builds eliminate the churn at the source; worth it if the noise is chronic.
- Some regulations require hash review; satisfy them with the dedicated check, not the change diff.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qFmg6PVLEyP2__bybDU7yg