See spack/spack#29930
I found this on the NOAA Cloud platforms. Pkgconf is defined as an external, but it's not being used in all instances, and pkg-config is being used, resulting in different hashes for NetCDF. My solution was to set pkg-config to buildable: False.