---
title: "Appendix: Apple Silicon Attestation Bundle Contents"
framework: Private Cloud Compute Security Guide
role: article
role_heading: Article
path: private-cloud-compute/appendix_attestationbundle
---

# Appendix: Apple Silicon Attestation Bundle Contents

The contents and validation of an attestation bundle.

## Overview

Overview Attestation bundles are Protobuf-encoded data structures with the following schema: message AttestationBundle {     bytes sep_attestation = 1; // DER-encoded SEP attestation     bytes ap_ticket = 2; // DER-encoded AP Image4 manifest     SealedHashLedger sealed_hashes = 3;     repeated bytes provisioning_certificate_chain = 4;     bytes app_data = 5; // Application-case specific metadata. Authenticated via SEP attestation anti-replay value.     google.protobuf.Timestamp key_expiration = 6; // Unix timestamp of the key's expiration, as hinted by the attested device     TransparencyProofs transparency_proofs = 8; }

message SealedHashLedger {     map<string, SealedHash> slots = 1; }

message SealedHash {     HashAlg hash_alg = 1;     repeated Entry entries = 2;

message Entry {         int32 flags = 1; // Flags set for the sealed hash update         bytes digest = 2; // The bytes ratcheted into the software sealed register

oneof info {             Cryptex cryptex = 3; // Cryptex entry             Cryptex.Salt cryptex_salt = 4; // libCryptex defined value that serves as an end marker for a register             SecureConfig secure_config = 5; // SecureConfig Entry         }

map<string, bytes> metadata = 6;     } }

enum HashAlg {     HASH_ALG_UNKNOWN = 0;     HASH_ALG_SHA256 = 1;     HASH_ALG_SHA384 = 2; }

message Cryptex {     bytes image4_manifest = 1; // DER-encoded cryptex Image4 manifest

message Salt {     } }

message SecureConfig {     bytes entry = 1; // JSON-encoded darwin-init config     map<string, string> metadata = 2;     bytes data = 3; // The metadata, a newline, and the entry, concatenated }

message AppData {     uint32 version = 1;     string domain = 2; // Always "com.apple.PrivateCloudCompute"     string name = 3; // Distinguishes proxy nodes from inferencing nodes     google.protobuf.Any metadata = 4; // AttestationAppData for inferencing nodes, ProxyNodeMetadata for proxy nodes }

message AttestationAppData {     bytes rackId = 1;     bytes ensembleId = 2;     bytes bootId = 3; }

message ProxyNodeMetadata {     message ProxiedRelease {         bytes digest = 1;         proto.TransparencyProofs transparency_proofs = 2;     }

repeated ProxiedRelease proxied_release = 1; // Legacy trusted release set; 6A and later carry the proxy's own release only. }

message TransparencyProofs {     ATLogProofs proofs = 1; } The digest a node ratchets for a secure-config entry covers the metadata, a newline, and the entry, concatenated in order. The public part of the PCC node’s Attested Request Handling (REK) is released only under these conditions:  |  |  |   |  |  |   |  |  |   |  |  |   |  |  |   |  |  |   |  |  |   |  |  |   |  |  |   |  |  |   |  |  |   |  |  |