mvn.javacard.pro

The Maven repository for JavaCard developers.

NB! Migration started 2026-09-01

This repository is about moving off GitHub and Maven Central, for a modern JavaCard DX with less friction.

All open source Maven artefacts are moving from com.github.martinpaljak groupId to pro.javacard and during the migration the structure of this repository also changes.

/maven and /maven/SNAPSHOTS are discontinued and will be removed on 2027-08-31. Update your pom.xml or settings.xml today:

old: https://mvn.javacard.pro/maven/
new: https://mvn.javacard.pro/public/
old: https://mvn.javacard.pro/maven/SNAPSHOTS/
new: https://mvn.javacard.pro/public-snapshots/

Likewise, com.github.martinpaljak namespace is discontinued. Change your pom.xml coordinates accordingly:

old: <groupId>com.github.martinpaljak</groupId>
new: <groupId>pro.javacard</groupId>

What is here?

Tree	Holds
`/public`, `/public-snapshots`	Open source projects, reproducible from Git
`/vendors`	Publicly available dependencies from various vendors

Why is it here?

Java development experience has improved greatly over the past decade, but the friction in Java Card development still feels like it is year 2000 - uneven platform support, constant fiddling with zip files and fixed paths, work practices echoing decades of "enterprise approach".

Let's change this! (WIP)

Reproducibility

Any kind of external code - or binary artefact - is a supply chain risk. This repository acts as a convenience layer, but everything here can be rebuilt bit for bit from a git commit hash or the vendor's own .zip with a known hash. A reproducible build lets you verify the jar yourself while a signature only tells you who uploaded it. YMMV.

Open Source - /public

Use it

<repositories>
    <repository>
        <id>javacard-pro</id>
        <url>https://mvn.javacard.pro/public/</url>
    </repository>
    <repository>
        <id>javacard-pro-snapshots</id>
        <url>https://mvn.javacard.pro/public-snapshots/</url>
    </repository>
</repositories>

Only add the entry with /public-snapshots for development and nightly builds.

Contains GlobalPlatformPro, ant-javacard, JCardEngine, apdu4j and the rest of @martinpaljak's projects on GitHub.

Binary artefacts - /vendors

Use it

<repositories>
    <repository>
        <id>javacard-pro-vendors</id>
        <url>https://mvn.javacard.pro/vendors/</url>
        <snapshots><enabled>false</enabled></snapshots>
    </repository>
</repositories>

JavaCard SDKs

Oracle JavaCard SDK-s, one artifact per version, packaging zip:

vnd.oracle:javacard-sdk:2.1.1   ... :3.0.5u4
vnd.oracle:javacard-sdk:24.0    ... :26.0

Each zip is a reproducible repack of the matching folder in oracle_javacard_sdks.

GlobalPlatform APIs

The on-card API export files from the GlobalPlatform Card Specification and its amendments:

Artifact	Versions	Covers
`vnd.globalplatform:api`	1.1 to 1.8	The core `org.globalplatform` package
`vnd.globalplatform:contactless`	1.0 to 1.4	Amendment C, contactless services
`vnd.globalplatform:upgrade`	1.0, 1.1	Amendment H, ELF upgrade
`vnd.globalplatform:broker`	1.0, 1.1	Amendment J, broker interface

The same group holds filesystem, privacy, securechannel and securechannel-provider.

ETSI and 3GPP APIs

The UICC and SIM Java Card APIs from TS 102 241, TS 102 705, TS 31.130 and friends, all under vnd.etsi:

uicc-toolkit              sim-toolkit
uicc-access               sim-access
uicc-system               uicc-scws
uicc-suspendresume        uicc-access-bertlvfile
uicc-hci-framework        uicc-access-fileadministration
uicc-usim-toolkit         uicc-services-highupdatearray
uicc-usim-access          uicc-hci-services-cardemulation
uicc-usim-gba_u           uicc-hci-services-cltobserver
uicc-usim-geolocation     uicc-hci-services-connectivity
uicc-usim-suci            uicc-hci-services-readermode
uicc-toolkit-test

Naming

The groupId is vnd. with a vendor name. The artifactId is the Java package with dots turned into dashes, minus the part the group already says:

package: org.globalplatform.contactless
artifact: vnd.globalplatform:contactless
package: uicc.hci.framework
artifact: vnd.etsi:uicc-hci-framework

Every artifact is also addressable by the package AID in lower case hex:

vnd.aid:a00000015100:1.8

That coordinate is a redirect that relocates to the named artifact.

API stubs go in with <scope>provided</scope>.

Attribution

Every artifact is (re-)packaged from a publicly available source, and the copyright stays with its original publisher:

Oracle - JavaCard development kits, (c) Oracle and/or its affiliates. From the JavaCard SDK downloads.
GlobalPlatform - org.globalplatform export files, (c) GlobalPlatform, Inc. From the specification library.
ETSI - UICC and SIM APIs, (c) ETSI. From what is published at etsi.org.

Publishing

The repository is open to third-party publishers (over SSH). Mail hello@javacard.pro.