Some sources, notably svn checkouts, will always have different MD5-sum. This happens when things like 'svn checkout' resets file modification dates which are reflected in the checksum.
Therefore, when the md5sum differs fedora-review should also do a diff -r and report the results, leaving the actual interpretation to the reviewer.
Should fedora-review actually do it or just mention/suggest it ?
I am afraid that if lots of files change, the output is going to get huge.
Yes, I think f-r should do it. It's one of those things which takes time, and can be automated. As it's implemented, the only thing which goes to the report is a ok/not ok message. The actual diff is kept in a separate file for the reasons you describe.
fixed in 04601cf9ba