Hash of a normalization of the derivation, so this roughly means source, dependencies and the ‘build recipe’. The exception are fixed-output derivations, which are typically content-hashed.

That said, a lot of work is done in content-addressed hashing, but AFAIK it’s not the default yet.