Notes on the MyFaces Core 1.2.9 Release




Here's how you can help us test the distribution.

Download a nightly build of the distribution assemblies:

Configure a <repository> for Maven 2:

           <name>Apache Snapshot Repository</name>

And declare a dependency on the 1.2.9 snapshots:


Note: Maven 2.0.4 will not download a new version if one is already present in your local repository. You will need to delete $M2_REPO/org/apache/myfaces/core to force Maven to download the new version. (Usually, $M2_REPO is <your home directory>/.m2/repository .)

Test your application, then, let us know the results (good or bad!) on dev -at- (You must be subscribed to post. See:


Proposed Release Announcement


1. Preparing shared 3.0.8

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=3_0_8 -DdryRun=true

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=3_0_8 -Dresume=false

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=3_0_8 -Dresume=false

2. Preparing core 1.2.9

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=1_2_9 -DdryRun=true

mvn release:prepare -DtagBase= -Dusername=lu4242 -Dscm.password=??? -Dtag=1_2_9 -Dresume=false

3. Deploy on local repo

mvn clean deploy -DperformRelease=true -DaltDeploymentRepository=myfaces-local-staging::default::scp://localhost/home/lu4242/stage/repo129 -Psign-artifacts -Dpassphrase=??? 

   cd home/lu4242/stage/repo129
   scp -p -r org

4. JIRA Release Management

5. Next step is the TCK

6. Generate assembly

cd 1_2_9
mvn install -Pgenerate-assembly
cd assembly
mvn package

openssl md5 myfaces-core-1.2.9-src.tar.gz > myfaces-core-1.2.9-src.tar.gz.md5
openssl md5 >
openssl sha1 myfaces-core-1.2.9-src.tar.gz > myfaces-core-1.2.9-src.tar.gz.sha1
openssl sha1 >
gpg --armor --output myfaces-core-1.2.9-src.tar.gz.asc --detach-sig myfaces-core-1.2.9-src.tar.gz
gpg --armor --output --detach-sig

openssl md5 myfaces-core-1.2.9-bin.tar.gz > myfaces-core-1.2.9-bin.tar.gz.md5
openssl md5 >
openssl sha1 myfaces-core-1.2.9-bin.tar.gz > myfaces-core-1.2.9-bin.tar.gz.sha1
openssl sha1 >
gpg --armor --output myfaces-core-1.2.9-bin.tar.gz.asc --detach-sig myfaces-core-1.2.9-bin.tar.gz
gpg --armor --output --detach-sig

scp -p -r myfaces-core-1.2.9-bin*
scp -p -r myfaces-core-1.2.9-src*



I was running the needed tasks to get the 1.2.9 release of Apache
MyFaces core out.

The artifacts passed all TCK test.

Please note that this vote concerns all of the following parts:
 1. Maven artifact group "org.apache.myfaces.shared" v3.0.8  [1]
 2. Maven artifact group "org.apache.myfaces.core" v1.2.9  [1]

The artifacts are deployed to my private Apache account ([1] and [3] for binary and source packages).

The release notes could be found at [4].

Also the clirr test does not show binary incompatibilities with myfaces-api.

Please take a look at the "1.2.9" artifacts and vote!

Please note: This vote is "majority approval" with a minimum of three
+1 votes (see [3]).

[ ] +1 for community members who have reviewed the bits
[ ] +0
[ ] -1 for fatal flaws that should cause these bits not to be released,
 and why..............

Leonardo Uribe


8. Clirr report to check binary incompatibilities success

9. Vote closed, starting distribution

cd /home/lu4242/public_html/myfaces129binsrc/sources
cp * /www/
cd /home/lu4242/public_html/myfaces129binsrc/binaries
cp * /www/

Alternative for manual copy:

mvn clean deploy -DaltDeploymentRepository=myfaces-staging::default::scpexe:// -Psign-artifacts -DperformRelease=true -Dpassphrase=???

Alternative for manual copy:

mvn clean deploy -DaltDeploymentRepository=myfaces-staging::default::scpexe:// -Psign-artifacts -DperformRelease=true -Dpassphrase=???

10. Announce

Subject: [ANNOUNCE] MyFaces Core v1.2.9 Release

The Apache MyFaces team is pleased to announce the release of MyFaces Core 1.2.9.

MyFaces Core is a JavaServer(tm) Faces 1.2 implementation as specified by JSR-252.  MyFaces Core has passed Sun's JSR-252 TCK and is 100% compliant with the JSR-252 specification. 

Please note this release also contains a fix for:

MYFACES-2749 Encrypted View State does not include Message Authentication Code (MAC)

This fix prevents padding oracle attack on view state when client side state saving is used.

MyFaces Core 1.2.9 is available in both binary and source distributions.


MyFaces Core is also available in the central Maven repository under Group ID "org.apache.myfaces.core".

Release Notes - MyFaces Core - Version 1.2.9


    * [MYFACES-1834] - suffix added to component id when including files
    * [MYFACES-1838] - javax.crypto.BadPaddingException: Given final block not properly padded
    * [MYFACES-2433] - Variable name error in oamClearHiddenInput and oamSetHiddenInput: use formname instead of formName
    * [MYFACES-2463] - CLONE -<f:param> violates the JSF spec
    * [MYFACES-2491] - _ErrorPageWriter does not print component properties
    * [MYFACES-2525] - Split javax.faces package in OSGi
    * [MYFACES-2611] - UIComponentBase.getFacetsAndChildren() must not access the component's facets and children directly
    * [MYFACES-2684] - UIComponentBase.saveAttachedState save transient elements as null values on List case
    * [MYFACES-2685] - Cannot call invokeOnComponent on UIColumn without rowIndex
    * [MYFACES-2686] - javax.faces.FacesException: java.lang.NumberFormatException while initializing if MANIFEST.MF version exceeds int value
    * [MYFACES-2726] - CommandLink renderer do not escape \ characters in generated javascript
    * [MYFACES-2749] - Encrypted View State does not include Message Authentication Code (MAC)


    * [MYFACES-2679] - Use a constant to identify FacesCompositeELResolver.Scope value
    * [MYFACES-2680] - Cache renderKit used
    * [MYFACES-2691] - Enhance MessageUtils adding methods when custom library bundle should be scanned
    * [MYFACES-2737] - Cache FacesContext on UIComponentBase instances


Leonardo Uribe