Notes on the MyFaces Core 1.1.8 Release




Here's how you can help us test the distribution.

Download a nightly build of the distribution assemblies:

Configure a <repository> for Maven 2:

           <name>Apache Snapshot Repository</name>

And declare a dependency on the 1.1.8 snapshots:


Note: Maven 2.0.4 will not download a new version if one is already present in your local repository. You will need to delete $M2_REPO/org/apache/myfaces/core to force Maven to download the new version. (Usually, $M2_REPO is <your home directory>/.m2/repository .)

Test your application, then, let us know the results (good or bad!) on dev -at- (You must be subscribed to post. See:


Proposed Release Announcement


1. Preparing shared 2.0.11

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=2_0_11 -DdryRun=true

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=2_0_11 -Dresume=false

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=2_0_11 -Dresume=false

2. Preparing core 1.1.8

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=1_1_8 -DdryRun=true

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=1_1_8 -Dresume=false

3. Deploy on local repo

mvn clean deploy -DperformRelease=true -DaltDeploymentRepository=myfaces-local-staging::default::scp://localhost/home/lu4242/stage/repo118 -Psign-artifacts -Dpassphrase=??? 

mvn clean deploy -DperformRelease=true -DaltDeploymentRepository=myfaces-local-staging::default::scp://localhost/home/lu4242/stage/repo118 -Psign-artifacts -Dpassphrase=??? 

   cd home/lu4242/stage/repo
   scp -p -r org

4. JIRA Release Management

5. Generate assembly

cd 1_1_8
mvn install -Pgenerate-assembly
cd assembly
mvn assembly:assembly -Psign-artifacts -Dpassphrase=??? 

openssl md5 myfaces-core-1.1.8-src.tar.gz > myfaces-core-1.1.8-src.tar.gz.md5
openssl md5 >
openssl sha1 myfaces-core-1.1.8-src.tar.gz > myfaces-core-1.1.8-src.tar.gz.sha1
openssl sha1 >
gpg --armor --output myfaces-core-1.1.8-src.tar.gz.asc --detach-sig myfaces-core-1.1.8-src.tar.gz
gpg --armor --output --detach-sig

openssl md5 myfaces-core-1.1.8-bin.tar.gz > myfaces-core-1.1.8-bin.tar.gz.md5
openssl md5 >
openssl sha1 myfaces-core-1.1.8-bin.tar.gz > myfaces-core-1.1.8-bin.tar.gz.sha1
openssl sha1 >
gpg --armor --output myfaces-core-1.1.8-bin.tar.gz.asc --detach-sig myfaces-core-1.1.8-bin.tar.gz
gpg --armor --output --detach-sig

scp -p -r myfaces-core-1.1.8-bin*
scp -p -r myfaces-core-1.1.8-src*

6. TCK Test

7. Clirr check SUCCESS!

mvn clirr:check -DcomparisonVersion=1.1.6



I was running the needed tasks to get the 1.1.8 release of Apache
MyFaces core out.

The artifacts passed all TCK test.

Please note that this vote concerns all of the following parts:
 1. Maven artifact group "org.apache.myfaces.shared" v2.0.11  [1]
 2. Maven artifact group "org.apache.myfaces.core" v1.1.8  [1]

The artifacts are deployed to my private Apache account ([1] and [3] for binary and source packages).

The release notes could be found at [4].

Also the clirr test does not show binary incompatibilities with myfaces-api.

Please take a look at the "1.1.8" artifacts and vote!

Please note: This vote is "majority approval" with a minimum of three
+1 votes (see [3]).

[ ] +1 for community members who have reviewed the bits
[ ] +0
[ ] -1 for fatal flaws that should cause these bits not to be released,
 and why..............

Leonardo Uribe


9. Vote closed, starting distribution

cd /home/lu4242/public_html/myfaces118binsrc/sources
cp * /www/
cd /home/lu4242/public_html/myfaces118binsrc/binaries
cp * /www/

Alternative for manual copy:

mvn clean deploy -DaltDeploymentRepository=myfaces-staging::default::scpexe:// -Psign-artifacts -DperformRelease=true -Dpassphrase=???

Alternative for manual copy:

mvn clean deploy -DaltDeploymentRepository=myfaces-staging::default::scpexe:// -Psign-artifacts -Dpassphrase=??? -DperformRelease=true

10. Announce

Subject: [ANNOUNCE] MyFaces Core v1.1.8 Release

The Apache MyFaces team is pleased to announce the release of MyFaces Core 1.1.8.

MyFaces Core is a JavaServer(tm) Faces 1.1 implementation as specified by JSR-127.  MyFaces Core has passed Sun's JSR-127 TCK and is 100% compliant with the JSR-127 specification. 

Please note this release also contains a fix for:

MYFACES-2749 Encrypted View State does not include Message Authentication Code (MAC)

This fix prevents padding oracle attack on view state when client side state saving is used.

MyFaces Core 1.1.8 is available in both binary and source distributions.


MyFaces Core is also available in the central Maven repository under Group ID "org.apache.myfaces.core".

Release Notes - MyFaces Core - Version 1.1.8


    * [MYFACES-2006] - getTableIndex: Integer to String (ClassCastException)
    * [MYFACES-2382] - Duplicate id exception when weblogic portal and jsf native portlet (faces-adapter.jar) is used
    * [MYFACES-2525] - Split javax.faces package in OSGi
    * [MYFACES-2566] - HTMLEncoder requiring StringBuilder class from JDK 5
    * [MYFACES-2684] - UIComponentBase.saveAttachedState save transient elements as null values on List case
    * [MYFACES-2726] - CommandLink renderer do not escape \ characters in generated javascript
    * [MYFACES-2749] - Encrypted View State does not include Message Authentication Code (MAC)


    * [MYFACES-2680] - Cache renderKit used
    * [MYFACES-2691] - Enhance MessageUtils adding methods when custom library bundle should be scanned
    * [MYFACES-2737] - Cache FacesContext on UIComponentBase instances



Leonardo Uribe