Talmi¶
Talmi is a short-lived token service (STS). It exchanges a verified upstream identity (a CI pipeline's OIDC token), a human's GitHub login - for narrowly scoped, short-lived downstream tokens (a GitHub App installation token, a JFrog Artifactory access token), and records every exchange in an audit log.
Long-lived secrets in a build system are hard to rotate, hard to scope, and hard to audit. Talmi replaces them with a request-time exchange: the caller proves who it is, Talmi checks a policy, mints a token scoped to exactly what was asked for, and returns it with an expiry and a revocation handle.
The exchange¶
flowchart LR
C[CI / human] -->|upstream token + resources| V[verify issuer]
V --> A[authorize policy]
A --> R[resolve + mint provider token]
R --> L[lease + audit]
L -->|scoped short-lived token| C- Verify - the upstream token is checked against its issuer and becomes a principal.
- Authorize - the policy engine checks each requested
resource=actions, failing closed. - Resolve and mint - the least-privileged capable provider mints one token per batch.
- Persist and audit - the artifacts become a lease with a revocation secret and an audit entry.
Explore¶
-
Getting started
Install Talmi, run a server, and issue your first token.
-
Concepts
How issuers, realms, rules, capabilities, and leases fit together.
-
Configuration
Issuers, realms and providers, rules, secrets, and config sources.
-
Operations
Run and deploy the server, sessions and admin, auditing.
-
Security
The trust model and a checklist for exposing Talmi publicly.
-
CLI reference
Every command, flag, and the manifest format.