It’s computed here: Pkg.jl/Types.jl at master · JuliaLang/Pkg.jl · GitHub
So it’s a content hash of the deps and compat sections of Project.toml. Judging from the comment this is used to determine whether the Manifest is up to date with the Project.