It’s computed here: Pkg.jl/Types.jl at master · JuliaLang/Pkg.jl · GitHub
So it’s a content hash of the deps
and compat
sections of Project.toml
. Judging from the comment this is used to determine whether the Manifest is up to date with the Project.