mvn.javacard.pro#

The Maven repository for JavaCard developers.

NB! Migration started 2026-09-01#

This repository is about moving off GitHub and Maven Central, for a modern JavaCard DX with less friction.

All open source Maven artefacts are moving from com.github.martinpaljak groupId to pro.javacard and during the migration the structure of this repository also changes.

/maven and /maven/SNAPSHOTS are discontinued and will be removed on 2027-08-31. Update your pom.xml or settings.xml today:

old: https://mvn.javacard.pro/maven/
new: https://mvn.javacard.pro/public/
old: https://mvn.javacard.pro/maven/SNAPSHOTS/
new: https://mvn.javacard.pro/public-snapshots/

Likewise, com.github.martinpaljak namespace is discontinued. Change your pom.xml coordinates accordingly:

old: <groupId>com.github.martinpaljak</groupId>
new: <groupId>pro.javacard</groupId>

What is here?#

Tree	Holds
`/public`, `/public-snapshots`	Open source projects, reproducible from Git
`/vendors`	Publicly available dependencies from various vendors

Why is it here?#

The Java developer experience has improved greatly over the past decade, but the friction in JavaCard development still feels like it is year 2000 - uneven platform support, constant fiddling with zip files and fixed paths, work practices echoing decades of "enterprise approach".

Let's change this! (WIP)

Reproducibility#

Any kind of external code - or binary artefact - is a supply chain risk. This repository acts as a convenience layer, but everything here can be rebuilt bit for bit from a git commit hash or the vendor's own .zip with a known hash. A reproducible build lets you verify the jar yourself while a signature only tells you who uploaded it. YMMV.

Open Source - /public#

Use it#

<repositories>
    <repository>
        <id>javacard-pro</id>
        <url>https://mvn.javacard.pro/public/</url>
    </repository>
    <repository>
        <id>javacard-pro-snapshots</id>
        <url>https://mvn.javacard.pro/public-snapshots/</url>
    </repository>
</repositories>

Add the /public-snapshots entry only for development and nightly builds.

Contains GlobalPlatformPro, ant-javacard, JCardEngine, apdu4j and the rest of @martinpaljak's projects on GitHub.

Binary artefacts - /vendors#

Use it#

<repositories>
    <repository>
        <id>javacard-pro-vendors</id>
        <url>https://mvn.javacard.pro/vendors/</url>
        <snapshots><enabled>false</enabled></snapshots>
    </repository>
</repositories>

JavaCard SDKs#

Oracle JavaCard SDKs, one artifact per version, packaging zip:

vnd.oracle:javacard-sdk:2.1.1   ... :3.0.5u4
vnd.oracle:javacard-sdk:24.0    ... :26.0

Each zip is a reproducible repack of the matching folder in oracle_javacard_sdks.

GlobalPlatform APIs#

The on-card API export files from the GlobalPlatform Card Specification and its amendments:

Artifact	Versions	Covers
`vnd.globalplatform:api`	1.1 to 1.8	The core `org.globalplatform` package
`vnd.globalplatform:contactless`	1.0 to 1.4	Amendment C, contactless services
`vnd.globalplatform:upgrade`	1.0, 1.1	Amendment H, ELF upgrade
`vnd.globalplatform:broker`	1.0, 1.1	Amendment J, broker interface

The same group holds filesystem, privacy, securechannel and securechannel-provider.

ETSI and 3GPP APIs#

The UICC and SIM JavaCard APIs from TS 102 241, TS 102 705, TS 31.130 and friends, all under vnd.etsi:

uicc-toolkit              sim-toolkit
uicc-access               sim-access
uicc-system               uicc-scws
uicc-suspendresume        uicc-access-bertlvfile
uicc-hci-framework        uicc-access-fileadministration
uicc-usim-toolkit         uicc-services-highupdatearray
uicc-usim-access          uicc-hci-services-cardemulation
uicc-usim-gba_u           uicc-hci-services-cltobserver
uicc-usim-geolocation     uicc-hci-services-connectivity
uicc-usim-suci            uicc-hci-services-readermode
uicc-toolkit-test

Naming#

The groupId is vnd. with a vendor name. The artifactId is the Java package with dots turned into dashes, minus the part the group already says:

package: org.globalplatform.contactless
artifact: vnd.globalplatform:contactless
package: uicc.hci.framework
artifact: vnd.etsi:uicc-hci-framework

Every artifact is also addressable by the package AID in lowercase hex:

vnd.aid:a00000015100:1.8

That coordinate is a Maven relocation to the named artifact.

Declare the API stubs with <scope>provided</scope>.

Attribution#

Every artifact is (re-)packaged from a publicly available source, and the copyright stays with its original publisher:

Oracle - JavaCard development kits, (c) Oracle and/or its affiliates. From the JavaCard SDK downloads.
GlobalPlatform - org.globalplatform export files, (c) GlobalPlatform, Inc. From the specification library.
ETSI - UICC and SIM APIs, (c) ETSI. From what is published at etsi.org.

Publishing#

The repository is open to third-party publishers (over SSH). Mail hello@javacard.pro.