diff --git a/envsetup.sh b/envsetup.sh
index 6dc2aa9..4eede33 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -537,7 +537,10 @@
         echo $TOP
     else
         if [ -f $TOPFILE ] ; then
-            echo $PWD
+            # The following circumlocution (repeated below as well) ensures
+            # that we record the true directory name and not one that is
+            # faked up with symlink names.
+            PWD= /bin/pwd
         else
             # We redirect cd to /dev/null in case it's aliased to
             # a command that prints something as a side-effect
@@ -546,7 +549,7 @@
             T=
             while [ \( ! \( -f $TOPFILE \) \) -a \( $PWD != "/" \) ]; do
                 cd .. > /dev/null
-                T=$PWD
+                T=`PWD= /bin/pwd`
             done
             cd $HERE > /dev/null
             if [ -f "$T/$TOPFILE" ]; then
diff --git a/target/board/Android.mk b/target/board/Android.mk
index 7137082..ac8cb44 100644
--- a/target/board/Android.mk
+++ b/target/board/Android.mk
@@ -46,7 +46,7 @@
 $(INSTALLED_ANDROID_INFO_TXT_TARGET): $(board_info_txt)
 	$(call pretty,"Generated: ($@)")
 ifdef board_info_txt
-	$(hide) cat $< >> $@
+	$(hide) cat $< > $@
 else
 	$(hide) echo "board=$(TARGET_BOOTLOADER_BOARD_NAME)" > $@
 endif
diff --git a/target/product/security/README b/target/product/security/README
index b92693d..24f984c 100644
--- a/target/product/security/README
+++ b/target/product/security/README
@@ -1,13 +1,9 @@
-The following commands were used to generate the test key pair:
+The following commands were used to generate the test key pairs:
 
-  openssl genrsa -3 -out testkey.pem 2048
-
-  openssl req -new -x509 -key testkey.pem -out testkey.x509.pem -days 10000 \
-    -subj '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/emailAddress=android@android.com'
-
-  openssl pkcs8 -in testkey.pem -topk8 -outform DER -out testkey.pk8 -nocrypt
-
-Alternatively you can use the "mkkey.sh" command included in this directory.
+  development/tools/make_key testkey  '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/emailAddress=android@android.com'
+  development/tools/make_key platform '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/emailAddress=android@android.com'
+  development/tools/make_key shared   '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/emailAddress=android@android.com'
+  development/tools/make_key media    '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/emailAddress=android@android.com'
 
 The following standard test keys are currently included:
 
@@ -28,11 +24,11 @@
    % openssl pkcs8 -inform DER -nocrypt -in testkey.pk8 -out testkey.pem
 
 2. create a signature using the pem format key
-   % openssl dgst -binary -sha1 -sign testkey.pem FILE > FILE.sig 
+   % openssl dgst -binary -sha1 -sign testkey.pem FILE > FILE.sig
 
 extracting public keys for embedding
 ------------------------------------
 it's a Java tool
 but it generates C code
 take a look at commands/recovery/Android.mk
-you'll see it running $(HOST_OUT_JAVA_LIBRARIES)/dumpkey.jar
\ No newline at end of file
+you'll see it running $(HOST_OUT_JAVA_LIBRARIES)/dumpkey.jar
diff --git a/target/product/security/mkkey.sh b/target/product/security/mkkey.sh
deleted file mode 100644
index 86744f6..0000000
--- a/target/product/security/mkkey.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-if ["$1" == ""]; then
-	echo "Create a test certificate key."
-	echo "Usage: $0 NAME"
-	echo "Will generate NAME.pk8 and NAME.x509.pem"
-	echo "  /C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/emailAddress=android@android.com"
-	return
-fi
-
-openssl genrsa -3 -out $1.pem 2048
-
-openssl req -new -x509 -key $1.pem -out $1.x509.pem -days 10000 \
-    -subj '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/emailAddress=android@android.com'
-
-openssl pkcs8 -in $1.pem -topk8 -outform DER -out $1.pk8 -nocrypt
-
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 27264dd..26f216d 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -35,6 +35,7 @@
 OPTIONS.verbose = False
 OPTIONS.tempfiles = []
 OPTIONS.device_specific = None
+OPTIONS.extras = {}
 
 class ExternalError(RuntimeError): pass
 
@@ -259,6 +260,10 @@
       Path to the python module containing device-specific
       releasetools code.
 
+  -x  (--extra)  <key=value>
+      Add a key/value pair to the 'extras' dict, which device-specific
+      extension code may look at.
+
   -v  (--verbose)
       Show command lines being executed.
 
@@ -283,8 +288,8 @@
 
   try:
     opts, args = getopt.getopt(
-        argv, "hvp:s:" + extra_opts,
-        ["help", "verbose", "path=", "device_specific="] +
+        argv, "hvp:s:x:" + extra_opts,
+        ["help", "verbose", "path=", "device_specific=", "extra="] +
           list(extra_long_opts))
   except getopt.GetoptError, err:
     Usage(docstring)
@@ -303,6 +308,9 @@
       OPTIONS.search_path = a
     elif o in ("-s", "--device_specific"):
       OPTIONS.device_specific = a
+    elif o in ("-x", "--extra"):
+      key, value = a.split("=", 1)
+      OPTIONS.extras[key] = value
     else:
       if extra_option_handler is None or not extra_option_handler(o, a):
         assert False, "unknown option \"%s\"" % (o,)
@@ -437,6 +445,7 @@
     module."""
     for k, v in kwargs.iteritems():
       setattr(self, k, v)
+    self.extras = OPTIONS.extras
 
     if self.module is None:
       path = OPTIONS.device_specific