diff --git a/CleanSpec.mk b/CleanSpec.mk
index 481829a..b1b139a 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -122,6 +122,11 @@
 # Changing where ro.carrier value is instantiated for system/build.prop
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/build.prop)
 
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/APPS/*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/app/*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/data/app/*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/build.prop)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 38c2c10..249ecba 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -226,7 +226,8 @@
 aidl_preprocess_import :=
 LOCAL_SDK_VERSION:=$(strip $(LOCAL_SDK_VERSION))
 ifdef LOCAL_SDK_VERSION
-ifeq ($(LOCAL_SDK_VERSION),current)
+ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
+  # LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS
   aidl_preprocess_import := $(TARGET_OUT_COMMON_INTERMEDIATES)/framework.aidl
 else
   aidl_preprocess_import := $(HISTORICAL_SDK_VERSIONS_ROOT)/$(LOCAL_SDK_VERSION)/framework.aidl
@@ -399,7 +400,8 @@
 ifeq ($(LOCAL_SDK_VERSION),)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,core)
 else
-ifeq ($(LOCAL_SDK_VERSION),current)
+ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
+# LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,android_stubs_current)
 else
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,sdk_v$(LOCAL_SDK_VERSION))
diff --git a/core/combo/TARGET_linux-x86.mk b/core/combo/TARGET_linux-x86.mk
index 9e1d4bd..dc4afb8 100644
--- a/core/combo/TARGET_linux-x86.mk
+++ b/core/combo/TARGET_linux-x86.mk
@@ -139,6 +139,7 @@
 TARGET_GLOBAL_LDFLAGS += -m32
 
 TARGET_GLOBAL_LDFLAGS += -Wl,-z,noexecstack
+TARGET_GLOBAL_LDFLAGS += -Wl,-z,relro -Wl,-z,now
 TARGET_GLOBAL_LDFLAGS += -Wl,--gc-sections
 
 TARGET_C_INCLUDES := \
diff --git a/core/config.mk b/core/config.mk
index 620739f..f02fbef 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -303,7 +303,6 @@
 DX := $(HOST_OUT_EXECUTABLES)/dx
 ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign$(HOST_EXECUTABLE_SUFFIX)
 FINDBUGS := prebuilt/common/findbugs/bin/findbugs
-LOCALIZE := $(HOST_OUT_EXECUTABLES)/localize$(HOST_EXECUTABLE_SUFFIX)
 EMMA_JAR := external/emma/lib/emma$(COMMON_JAVA_PACKAGE_SUFFIX)
 
 # Deal with archaic version of bison on Mac OS X.
@@ -433,7 +432,7 @@
     ( sgrax $(1) | sort -g ) )
 endef
 
-TARGET_AVAILABLE_SDK_VERSIONS := current $(call numerically_sort,\
+TARGET_AVAILABLE_SDK_VERSIONS := $(call numerically_sort,\
     $(patsubst $(HISTORICAL_SDK_VERSIONS_ROOT)/%/android.jar,%, \
     $(wildcard $(HISTORICAL_SDK_VERSIONS_ROOT)/*/android.jar)))
 
diff --git a/core/droiddoc.mk b/core/droiddoc.mk
index 47f599d..e312965 100644
--- a/core/droiddoc.mk
+++ b/core/droiddoc.mk
@@ -64,7 +64,8 @@
 ifneq ($(LOCAL_IS_HOST_MODULE),true)
 
 ifneq ($(LOCAL_SDK_VERSION),)
-  ifeq ($(LOCAL_SDK_VERSION),current)
+  ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
+    # Use android_stubs_current if LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
     LOCAL_JAVA_LIBRARIES := android_stubs_current $(LOCAL_JAVA_LIBRARIES)
   else
     LOCAL_JAVA_LIBRARIES := sdk_v$(LOCAL_SDK_VERSION) $(LOCAL_JAVA_LIBRARIES)
diff --git a/core/java.mk b/core/java.mk
index 4005ce3..7e4af79 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -28,7 +28,8 @@
       $(error $(LOCAL_PATH): Invalid LOCAL_SDK_VERSION '$(LOCAL_SDK_VERSION)' \
              Choices are: $(TARGET_AVAILABLE_SDK_VERSIONS))
     else
-      ifeq ($(LOCAL_SDK_VERSION),current)
+      ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
+        # Use android_stubs_current if LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
         LOCAL_JAVA_LIBRARIES := android_stubs_current $(LOCAL_JAVA_LIBRARIES)
       else
         LOCAL_JAVA_LIBRARIES := sdk_v$(LOCAL_SDK_VERSION) $(LOCAL_JAVA_LIBRARIES)
@@ -166,7 +167,8 @@
 renderscript_flags += $(LOCAL_RENDERSCRIPT_FLAGS)
 
 # prepend the RenderScript system include path
-ifneq ($(filter-out current,$(LOCAL_SDK_VERSION)),)
+ifneq ($(filter-out current,$(LOCAL_SDK_VERSION))$(if $(TARGET_BUILD_APPS),$(filter current,$(LOCAL_SDK_VERSION))),)
+# if a numeric LOCAL_SDK_VERSION, or current LOCAL_SDK_VERSION with TARGET_BUILD_APPS
 LOCAL_RENDERSCRIPT_INCLUDES := \
     $(HISTORICAL_SDK_VERSIONS_ROOT)/renderscript/clang-include \
     $(HISTORICAL_SDK_VERSIONS_ROOT)/renderscript/include \
diff --git a/core/llvm_config.mk b/core/llvm_config.mk
index 966924e..bc90b95 100644
--- a/core/llvm_config.mk
+++ b/core/llvm_config.mk
@@ -1,5 +1,6 @@
 CLANG := $(HOST_OUT_EXECUTABLES)/clang$(HOST_EXECUTABLE_SUFFIX)
 CLANG_CXX := $(HOST_OUT_EXECUTABLES)/clang++$(HOST_EXECUTABLE_SUFFIX)
+LLVM_AS := $(HOST_OUT_EXECUTABLES)/llvm-as$(HOST_EXECUTABLE_SUFFIX)
 LLVM_LINK := $(HOST_OUT_EXECUTABLES)/llvm-link$(HOST_EXECUTABLE_SUFFIX)
 
 define do-clang-flags-subst
diff --git a/core/package.mk b/core/package.mk
index def715f..195b346 100644
--- a/core/package.mk
+++ b/core/package.mk
@@ -267,7 +267,7 @@
 # Most packages should link against the resources defined by framework-res.
 # Even if they don't have their own resources, they may use framework
 # resources.
-ifneq ($(filter-out current,$(LOCAL_SDK_RES_VERSION)),)
+ifneq ($(filter-out current,$(LOCAL_SDK_RES_VERSION))$(if $(TARGET_BUILD_APPS),$(filter current,$(LOCAL_SDK_RES_VERSION))),)
 # for released sdk versions, the platform resources were built into android.jar.
 framework_res_package_export := \
     $(HISTORICAL_SDK_VERSIONS_ROOT)/$(LOCAL_SDK_RES_VERSION)/android.jar
diff --git a/core/static_java_library.mk b/core/static_java_library.mk
index 9165050..367ea5f 100644
--- a/core/static_java_library.mk
+++ b/core/static_java_library.mk
@@ -64,7 +64,7 @@
 framework_res_package_export_deps :=
 # Please refer to package.mk
 ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
-ifneq ($(filter-out current,$(LOCAL_SDK_RES_VERSION)),)
+ifneq ($(filter-out current,$(LOCAL_SDK_RES_VERSION))$(if $(TARGET_BUILD_APPS),$(filter current,$(LOCAL_SDK_RES_VERSION))),)
 framework_res_package_export := \
     $(HISTORICAL_SDK_VERSIONS_ROOT)/$(LOCAL_SDK_RES_VERSION)/android.jar
 framework_res_package_export_deps := $(framework_res_package_export)
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index c97306c..021617d 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -41,7 +41,7 @@
   # which is the version that we reveal to the end user.
   # Update this value when the platform version changes (rather
   # than overriding it somewhere else).  Can be an arbitrary string.
-  PLATFORM_VERSION := JellyBean
+  PLATFORM_VERSION := 4.1
 endif
 
 ifeq "" "$(PLATFORM_SDK_VERSION)"
@@ -53,13 +53,13 @@
   # intermediate builds).  During development, this number remains at the
   # SDK version the branch is based on and PLATFORM_VERSION_CODENAME holds
   # the code-name of the new development work.
-  PLATFORM_SDK_VERSION := 15
+  PLATFORM_SDK_VERSION := 16
 endif
 
 ifeq "" "$(PLATFORM_VERSION_CODENAME)"
   # This is the current development code-name, if the build is not a final
   # release build.  If this is a final release build, it is simply "REL".
-  PLATFORM_VERSION_CODENAME := JellyBean
+  PLATFORM_VERSION_CODENAME := REL
 endif
 
 ifeq "" "$(DEFAULT_APP_TARGET_SDK)"
diff --git a/target/product/core.mk b/target/product/core.mk
index 8170c2f..58002a7 100644
--- a/target/product/core.mk
+++ b/target/product/core.mk
@@ -75,6 +75,7 @@
     libaudiopreprocessing \
     libaudioutils \
     libcrypto \
+    libdownmix \
     libdvm \
     libdrmframework \
     libdrmframework_jni \
@@ -98,6 +99,7 @@
     libstagefright_soft_amrdec \
     libstagefright_soft_amrnbenc \
     libstagefright_soft_amrwbenc \
+    libstagefright_soft_flacenc \
     libstagefright_soft_g711dec \
     libstagefright_soft_h264dec \
     libstagefright_soft_h264enc \
diff --git a/target/product/generic_no_telephony.mk b/target/product/generic_no_telephony.mk
index 4a1643a..918827d 100644
--- a/target/product/generic_no_telephony.mk
+++ b/target/product/generic_no_telephony.mk
@@ -29,6 +29,7 @@
     Email \
     Exchange2 \
     Gallery2 \
+    InputDevices \
     LatinIME \
     Launcher2 \
     Music \
@@ -53,8 +54,7 @@
     librs_jni \
     libvideoeditor_jni \
     libvideoeditorplayer \
-    libvideoeditor_core \
-    libdownmix
+    libvideoeditor_core
 
 PRODUCT_PACKAGES += \
     audio.primary.default \
diff --git a/target/product/sdk.mk b/target/product/sdk.mk
index 5abdd55..a5d941e 100644
--- a/target/product/sdk.mk
+++ b/target/product/sdk.mk
@@ -42,6 +42,7 @@
 	SdkSetup \
 	CustomLocale \
 	sqlite3 \
+	InputDevices \
 	LatinIME \
 	CertInstaller \
 	LiveWallpapersPicker \
diff --git a/tools/signapk/SignApk.java b/tools/signapk/SignApk.java
index c4d73c8..d8d9bf1 100644
--- a/tools/signapk/SignApk.java
+++ b/tools/signapk/SignApk.java
@@ -76,6 +76,8 @@
     private static final String CERT_SF_NAME = "META-INF/CERT.SF";
     private static final String CERT_RSA_NAME = "META-INF/CERT.RSA";
 
+    private static final String OTACERT_NAME = "META-INF/com/android/otacert";
+
     // Files matching this pattern are not copied to the output.
     private static Pattern stripPattern =
             Pattern.compile("^META-INF/(.*)[.](SF|RSA|DSA)$");
@@ -199,6 +201,7 @@
             String name = entry.getName();
             if (!entry.isDirectory() && !name.equals(JarFile.MANIFEST_NAME) &&
                 !name.equals(CERT_SF_NAME) && !name.equals(CERT_RSA_NAME) &&
+                !name.equals(OTACERT_NAME) &&
                 (stripPattern == null ||
                  !stripPattern.matcher(name).matches())) {
                 InputStream data = jar.getInputStream(entry);
@@ -217,6 +220,39 @@
         return output;
     }
 
+    /**
+     * Add a copy of the public key to the archive; this should
+     * exactly match one of the files in
+     * /system/etc/security/otacerts.zip on the device.  (The same
+     * cert can be extracted from the CERT.RSA file but this is much
+     * easier to get at.)
+     */
+    private static void addOtacert(JarOutputStream outputJar,
+                                   File publicKeyFile,
+                                   long timestamp,
+                                   Manifest manifest)
+        throws IOException, GeneralSecurityException {
+        BASE64Encoder base64 = new BASE64Encoder();
+        MessageDigest md = MessageDigest.getInstance("SHA1");
+
+        JarEntry je = new JarEntry(OTACERT_NAME);
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        FileInputStream input = new FileInputStream(publicKeyFile);
+        byte[] b = new byte[4096];
+        int read;
+        while ((read = input.read(b)) != -1) {
+            outputJar.write(b, 0, read);
+            md.update(b, 0, read);
+        }
+        input.close();
+
+        Attributes attr = new Attributes();
+        attr.putValue("SHA1-Digest", base64.encode(md.digest()));
+        manifest.getEntries().put(OTACERT_NAME, attr);
+    }
+
+
     /** Write to another stream and also feed it to the Signature object. */
     private static class SignatureOutputStream extends FilterOutputStream {
         private Signature mSignature;
@@ -445,7 +481,8 @@
         FileOutputStream outputFile = null;
 
         try {
-            X509Certificate publicKey = readPublicKey(new File(args[argstart+0]));
+            File publicKeyFile = new File(args[argstart+0]);
+            X509Certificate publicKey = readPublicKey(publicKeyFile);
 
             // Assume the certificate is valid for at least an hour.
             long timestamp = publicKey.getNotBefore().getTime() + 3600L * 1000;
@@ -464,8 +501,17 @@
 
             JarEntry je;
 
-            // MANIFEST.MF
             Manifest manifest = addDigestsToManifest(inputJar);
+
+            // Everything else
+            copyFiles(manifest, inputJar, outputJar, timestamp);
+
+            // otacert
+            if (signWholeFile) {
+                addOtacert(outputJar, publicKeyFile, timestamp, manifest);
+            }
+
+            // MANIFEST.MF
             je = new JarEntry(JarFile.MANIFEST_NAME);
             je.setTime(timestamp);
             outputJar.putNextEntry(je);
@@ -486,9 +532,6 @@
             outputJar.putNextEntry(je);
             writeSignatureBlock(signature, publicKey, outputJar);
 
-            // Everything else
-            copyFiles(manifest, inputJar, outputJar, timestamp);
-
             outputJar.close();
             outputJar = null;
             outputStream.flush();