COPS TLS and Crypto Workbench
Review TLS chains, mTLS client authorization and JWT/JWKS signing configuration using ephemeral laboratory credentials.
Maturity: experimental. Offline correction playback is available. Laboratory isolation, host installation and production integrations remain unverified.
Usage
From the repository, inspect the package metadata, run its fixture playback, and validate its package contract:
python3 -m cops info tls-crypto-workbench
python3 -m cops demo tls-crypto-workbench
python3 -m cops check tls-crypto-workbench
From an exported package, run python3 scripts/demo.py. Inspect supplied input
with python3 scripts/assess.py --input examples/input.json --as-of 2026-10-15T12:00:00Z.
Create a strict native report with python3 scripts/report.py --input examples/input.json --as-of 2026-10-15T12:00:00Z --report-id report-demo --engagement-id eng-demo --scenario-id COPS-DEMO --result-id res-demo --target fixture:tls-demo. The caller must supply those context identifiers;
the wrapper does not invent engagement or target provenance.
Design
The package uses the bounded COPS artifact assessment engine and content-free
SHA-256 evidence references. An immutable copy of its runtime is included in
vendor/runtime; update it using the repository runtime synchronization script.
The assessment does not establish production exploitability or compliance.
Optional typed certificate and JWT verification uses
cryptography==50.0.2 with explicit local trust and assessment time. It verifies
signatures and client identity authorization without network discovery. Legacy
metadata inputs and dependency-free demos remain compatible.
Data Contract
| Artifact | Purpose | Producer | Consumer | Validation |
|---|---|---|---|---|
examples/input.json | Supplied artifact envelope | Authorized collector | Assessment engine | Type and byte bounds |
examples/correction-cases.json | Correction acceptance cases | Synthetic fixture author | Demo and package checks | Expected codes and content hashes |
| Assessment result | Findings, coverage and limitations | Engine | Reviewer or report exporter | Native Finding contract and SHA-256 |
| Assessment report | Strict imported-evidence report | scripts/report.py | Native report exporter | cops.assessment-report/v1 semantic validation |
See the runnable playbook, verification, and walkthrough.