JSF was developed through the Java Community Process, and like any other Java Specification Request (JSR), there are two primary pieces that most people see: a specification and a reference implementation (RI). For many JSRs, including the JSF one, anybody, including open source organizations, can implement the specification. The RI, on the other hand, doesn't have to be open source -- that's up to the specification lead (Sun in this case) and the expert group.

For JSF, the RI (called "Mojarra") is fully open source, available through both the CDDL or GPLv2 licenses. The other primary implementation, MyFaces, is open source as well (released under the Apache license).

There are also open source implementations available.