--- a/jdk/make/com/sun/crypto/provider/Makefile	Wed Apr 02 22:44:45 2008 -0400
+++ b/jdk/make/com/sun/crypto/provider/Makefile	Sun Apr 06 10:15:03 2008 -0700
@@ -1,5 +1,5 @@
 #
-# Copyright 2007 Sun Microsystems, Inc.  All Rights Reserved.
+# Copyright 2007-2008 Sun Microsystems, Inc.  All Rights Reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -87,8 +87,7 @@
 #     sign			Alias for sign-jar
 #	  sign-jar		Builds/signs sunjce_provider.jar (no install)
 #
-#     obfus			Builds/obfuscates/signs/installs
-#				sunjce_provider.jar
+#     obfus			Builds/obfuscates/signs sunjce_provider.jar
 #
 #     release			Builds all targets in preparation
 #				for workspace integration.
@@ -101,8 +100,25 @@
 BUILDDIR = ../../../..
 PACKAGE = com.sun.crypto.provider
 PRODUCT = sun
+
+#
+# The following is for when we need to do postprocessing
+# (signing/obfuscation) against a read-only build.  If the OUTPUTDIR
+# isn't writable, the build currently crashes out.
+#
+ifndef OPENJDK
+  ifdef ALT_JCE_BUILD_DIR
+    # =====================================================
+    # Where to place the output, in case we're building from a read-only
+    # build area.  (e.g. a release engineering build.)
+    JCE_BUILD_DIR=${ALT_JCE_BUILD_DIR}
+    IGNORE_WRITABLE_OUTPUTDIR_TEST=true
+  else
+    JCE_BUILD_DIR=${TEMPDIR}
+  endif
+endif
+
 include $(BUILDDIR)/common/Defs.gmk
-include $(BUILDDIR)/javax/crypto/Defs-jce.gmk
 
 #
 # Location for the newly built classfiles.
@@ -147,6 +163,8 @@
 #
 UNSIGNED_DIR = $(TEMPDIR)/unsigned
 
+include $(BUILDDIR)/javax/crypto/Defs-jce.gmk
+
 
 # =====================================================
 # Build the unsigned sunjce_provider.jar file.
@@ -184,44 +202,66 @@
 # Sign the provider jar file.  Not needed for OpenJDK.
 #
 
-SIGNED_DIR = $(TEMPDIR)/signed
+SIGNED_DIR = $(JCE_BUILD_DIR)/signed
 
 sign: sign-jar
 
 sign-jar: $(SIGNED_DIR)/sunjce_provider.jar
 
+ifndef ALT_JCE_BUILD_DIR
 $(SIGNED_DIR)/sunjce_provider.jar: $(UNSIGNED_DIR)/sunjce_provider.jar
-	$(sign-file)
+else
+#
+# We have to remove the build dependency, otherwise, we'll try to rebuild it
+# which we can't do on a read-only filesystem.
+#
+$(SIGNED_DIR)/sunjce_provider.jar:
+	@if [ ! -r $(UNSIGNED_DIR)/sunjce_provider.jar ] ; then \
+	    $(ECHO) "Couldn't find $(UNSIGNED_DIR)/sunjce_provider.jar"; \
+	    exit 1; \
+	fi
+endif
+	$(call sign-file, $(UNSIGNED_DIR)/sunjce_provider.jar)
 
 # =====================================================
 # Obfuscate/sign/install the JDK build.  Not needed for OpenJDK.
 #
 
-OBFUS_DIR = $(TEMPDIR)/obfus
+OBFUS_DIR = $(JCE_BUILD_DIR)/obfus/sunjce
 
 CLOSED_DIR = $(BUILDDIR)/closed/com/sun/crypto/provider
 
 obfus: $(OBFUS_DIR)/sunjce_provider.jar
 	$(release-warning)
 
-$(OBFUS_DIR)/sunjce_provider.jar: build-jar $(JCE_MANIFEST_FILE)
+ifndef ALT_JCE_BUILD_DIR
+$(OBFUS_DIR)/sunjce_provider.jar: build-jar $(JCE_MANIFEST_FILE) \
+	    $(OBFUS_DIR)/sunjce.dox
+else
+$(OBFUS_DIR)/sunjce_provider.jar: $(JCE_MANIFEST_FILE) $(OBFUS_DIR)/sunjce.dox
+	@if [ ! -d $(CLASSDESTDIR) ] ; then \
+	    $(ECHO) "Couldn't find $(CLASSDESTDIR)"; \
+	    exit 1; \
+	fi
+endif
+	@$(ECHO) ">>>Obfuscating SunJCE Provider..."
 	$(presign)
 	$(preobfus)
-	@$(ECHO) ">>>Obfuscating Sun JCE Provider..."
 	$(prep-target)
 	$(CD) $(OBFUS_DIR); \
-	$(OBFUSCATOR) -fv \
-	    $(CURRENT_DIRECTORY)/$(CLOSED_DIR)/obfus/sunjce.dox
+	$(OBFUSCATOR) -fv sunjce.dox
 	@$(CD) $(OBFUS_DIR); $(java-vm-cleanup)
 	$(BOOT_JAR_CMD) cmf $(JCE_MANIFEST_FILE) $@ \
 	    -C $(OBFUS_DIR)/build com \
 	    $(JAR_JFLAGS)
 	$(sign-target)
-	$(MKDIR) -p $(dir $(JAR_DESTFILE))
-	$(RM) $(JAR_DESTFILE)
-	$(CP) $@ $(JAR_DESTFILE)
 	@$(java-vm-cleanup)
 
+$(OBFUS_DIR)/sunjce.dox: $(CLOSED_DIR)/obfus/sunjce.dox
+	@$(ECHO) ">>>Creating sunjce.dox"
+	$(prep-target)
+	$(SED) "s:@@TEMPDIR@@:$(ABS_TEMPDIR):" $< > $@
+
 #
 # The current obfuscator has a limitation in that it currently only
 # supports up to v49 class file format.  Force v49 classfiles in our
@@ -235,9 +275,9 @@
 #
 
 release: $(OBFUS_DIR)/sunjce_provider.jar
-	$(RM) $(RELEASE_DIR)/sunjce_provider.jar
-	$(MKDIR) -p $(RELEASE_DIR)
-	$(CP) $(OBFUS_DIR)/sunjce_provider.jar $(RELEASE_DIR)
+	$(RM) $(JCE_BUILD_DIR)/release/sunjce_provider.jar
+	$(MKDIR) -p $(JCE_BUILD_DIR)/release
+	$(CP) $(OBFUS_DIR)/sunjce_provider.jar $(JCE_BUILD_DIR)/release
 	$(release-warning)
 
 endif # OPENJDK
@@ -275,7 +315,7 @@
 #
 
 clobber clean::
-	$(RM) -r $(JAR_DESTFILE) $(TEMPDIR)
+	$(RM) -r $(JAR_DESTFILE) $(TEMPDIR) $(JCE_BUILD_DIR)
 
 .PHONY: build-jar jar install-jar
 ifndef OPENJDK

--- a/jdk/make/common/shared/Defs.gmk	Wed Apr 02 22:44:45 2008 -0400
+++ b/jdk/make/common/shared/Defs.gmk	Sun Apr 06 10:15:03 2008 -0700
@@ -1,5 +1,5 @@
 #
-# Copyright 2005-2007 Sun Microsystems, Inc.  All Rights Reserved.
+# Copyright 2005-2008 Sun Microsystems, Inc.  All Rights Reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -449,11 +449,20 @@
 # Check for spaces and null value
 OUTPUTDIR:=$(call AltCheckSpaces,OUTPUTDIR)
 OUTPUTDIR:=$(call AltCheckValue,OUTPUTDIR)
+
+#
+# When signing the JCE framework and provider, we could be using built
+# bits on a read-only filesystem.  If so, this test will fail and crash
+# the build.
+#
+ifndef IGNORE_WRITABLE_OUTPUTDIR_TEST
 # Create the output directory and make sure it exists and is writable
 _create_outputdir:=$(shell $(MKDIR) -p "$(OUTPUTDIR)" > $(DEV_NULL) 2>&1)
 ifeq ($(call WriteDirExists,$(OUTPUTDIR),/dev/null),/dev/null)
   _outputdir_error:=$(error "ERROR: OUTPUTDIR '$(OUTPUTDIR)' not created or not writable")
 endif
+endif
+
 # Define absolute path if needed and check for spaces and null value
 ifndef ABS_OUTPUTDIR
   ABS_OUTPUTDIR:=$(call FullPath,$(OUTPUTDIR))

--- a/jdk/make/javax/crypto/Defs-jce.gmk	Wed Apr 02 22:44:45 2008 -0400
+++ b/jdk/make/javax/crypto/Defs-jce.gmk	Sun Apr 06 10:15:03 2008 -0700
@@ -1,5 +1,5 @@
 #
-# Copyright 2007 Sun Microsystems, Inc.  All Rights Reserved.
+# Copyright 2007-2008 Sun Microsystems, Inc.  All Rights Reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,7 @@
 JCE_MANIFEST_FILE    = $(TEMPDIR)/manifest.mf
 $(JCE_MANIFEST_FILE): $(MAINMANIFEST)
 	$(prep-target)
-	( $(SED) "s/@@RELEASE@@/$(RELEASE)/" $(MAINMANIFEST); \
+	( $(SED) "s/@@RELEASE@@/$(RELEASE)/" $<; \
 	    $(ECHO) "Extension-Name: javax.crypto"; \
 	    $(ECHO) "Implementation-Vendor-Id: com.sun"; ) > $@
 
@@ -75,6 +75,7 @@
 define sign-target
 	$(BOOT_JARSIGNER_CMD) -keystore $(SIGNING_KEYSTORE) \
 	    $@ $(SIGNING_ALIAS) < $(SIGNING_PASSPHRASE)
+	@$(java-vm-cleanup)
 	@$(ECHO) "\nJar codesigning finished."
 endef
 
@@ -88,13 +89,15 @@
 endef
 
 #
-# Convenience macro for steps needed to sign a jar file.
+# Convenience macros for signing a jar file.
+#
+# Call through $(call sign-file, target file)
 #
 define sign-file
 	$(presign)
-	$(install-file)
+	$(prep-target)
+	$(CP) $1 $@
 	$(sign-target)
-	@$(java-vm-cleanup)
 endef
 
 #

--- a/jdk/make/javax/crypto/Makefile	Wed Apr 02 22:44:45 2008 -0400
+++ b/jdk/make/javax/crypto/Makefile	Sun Apr 06 10:15:03 2008 -0700
@@ -1,5 +1,5 @@
 #
-# Copyright 2007 Sun Microsystems, Inc.  All Rights Reserved.
+# Copyright 2007-2008 Sun Microsystems, Inc.  All Rights Reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -96,7 +96,7 @@
 #	  sign-jar		Builds/signs jce.jar file (no install)
 #	  sign-policy		Builds/signs policy files (no install)
 #
-#     obfus			Builds/obfuscates/signs/installs jce.jar
+#     obfus			Builds/obfuscates/signs jce.jar
 #
 #     release			Builds all targets in preparation
 #				for workspace integration.
@@ -110,8 +110,24 @@
 PACKAGE = javax.crypto
 PRODUCT = sun
 
+#
+# The following is for when we need to do postprocessing
+# (signing/obfuscation) against a read-only build.  If the OUTPUTDIR
+# isn't writable, the build currently crashes out.
+#
+ifndef OPENJDK
+  ifdef ALT_JCE_BUILD_DIR
+    # =====================================================
+    # Where to place the output, in case we're building from a read-only
+    # build area.  (e.g. a release engineering build.)
+    JCE_BUILD_DIR=${ALT_JCE_BUILD_DIR}
+    IGNORE_WRITABLE_OUTPUTDIR_TEST=true
+  else
+    JCE_BUILD_DIR=${TEMPDIR}
+  endif
+endif
+
 include $(BUILDDIR)/common/Defs.gmk
-include Defs-jce.gmk
 
 #
 # Location for the newly built classfiles.
@@ -158,6 +174,8 @@
 #
 UNSIGNED_DIR = $(TEMPDIR)/unsigned
 
+include Defs-jce.gmk
+
 
 # =====================================================
 # Build the unsigned jce.jar file.  Signing/obfuscation comes later.
@@ -299,7 +317,7 @@
 # Sign the various jar files.  Not needed for OpenJDK.
 #
 
-SIGNED_DIR		= $(TEMPDIR)/signed
+SIGNED_DIR		= $(JCE_BUILD_DIR)/signed
 SIGNED_POLICY_BUILDDIR	= $(SIGNED_DIR)/policy
 
 SIGNED_POLICY_FILES = \
@@ -312,61 +330,87 @@
 
 sign-policy: $(SIGNED_POLICY_FILES)
 
+ifndef ALT_JCE_BUILD_DIR
 $(SIGNED_DIR)/jce.jar: $(UNSIGNED_DIR)/jce.jar
-	$(sign-file)
+else
+#
+# We have to remove the build dependency, otherwise, we'll try to rebuild it
+# which we can't do on a read-only filesystem.
+#
+$(SIGNED_DIR)/jce.jar:
+	@if [ ! -r $(UNSIGNED_DIR)/jce.jar ] ; then \
+	    $(ECHO) "Couldn't find $(UNSIGNED_DIR)/jce.jar"; \
+	    exit 1; \
+	fi
+endif
+	$(call sign-file, $(UNSIGNED_DIR)/jce.jar)
 
 $(SIGNED_POLICY_BUILDDIR)/unlimited/US_export_policy.jar:	\
-$(UNSIGNED_POLICY_BUILDDIR)/unlimited/US_export_policy.jar
-	$(sign-file)
+	    $(UNSIGNED_POLICY_BUILDDIR)/unlimited/US_export_policy.jar
+	$(call sign-file, $<)
 
 $(SIGNED_POLICY_BUILDDIR)/unlimited/local_policy.jar:		\
-$(UNSIGNED_POLICY_BUILDDIR)/unlimited/local_policy.jar
-	$(sign-file)
+	    $(UNSIGNED_POLICY_BUILDDIR)/unlimited/local_policy.jar
+	$(call sign-file, $<)
 
 $(SIGNED_POLICY_BUILDDIR)/limited/US_export_policy.jar:		\
-$(UNSIGNED_POLICY_BUILDDIR)/limited/US_export_policy.jar
-	$(sign-file)
+	    $(UNSIGNED_POLICY_BUILDDIR)/limited/US_export_policy.jar
+	$(call sign-file, $<)
 
 $(SIGNED_POLICY_BUILDDIR)/limited/local_policy.jar:		\
-$(UNSIGNED_POLICY_BUILDDIR)/limited/local_policy.jar
-	$(sign-file)
+	    $(UNSIGNED_POLICY_BUILDDIR)/limited/local_policy.jar
+	$(call sign-file, $<)
 
 
 # =====================================================
 # Obfuscate/sign/install the JDK build.  Not needed for OpenJDK.
 #
 
-OBFUS_DIR = $(TEMPDIR)/obfus
+OBFUS_DIR = $(JCE_BUILD_DIR)/obfus/jce
 
 CLOSED_DIR = $(BUILDDIR)/closed/javax/crypto
 
 obfus: $(OBFUS_DIR)/jce.jar
 	$(release-warning)
 
-$(OBFUS_DIR)/jce.jar: build-jar $(JCE_MANIFEST_FILE)
+ifndef ALT_JCE_BUILD_DIR
+$(OBFUS_DIR)/jce.jar: build-jar $(JCE_MANIFEST_FILE) $(OBFUS_DIR)/framework.dox
+else
+#
+# We have to remove the build dependency, otherwise, we'll try to rebuild it
+# which we can't do on a read-only filesystem.
+#
+$(OBFUS_DIR)/jce.jar: $(JCE_MANIFEST_FILE) $(OBFUS_DIR)/framework.dox
+	@if [ ! -d $(CLASSDESTDIR) ] ; then \
+	    $(ECHO) "Couldn't find $(CLASSDESTDIR)"; \
+	    exit 1; \
+	fi
+endif
+	@$(ECHO) ">>>Obfuscating JCE framework..."
 	$(presign)
 	$(preobfus)
-	@$(ECHO) ">>>Obfuscating JCE framework..."
 	$(prep-target)
 	$(CD) $(OBFUS_DIR); \
-	$(OBFUSCATOR) -fv \
-	    $(CURRENT_DIRECTORY)/$(CLOSED_DIR)/obfus/framework.dox
+	$(OBFUSCATOR) -fv framework.dox
 	@$(CD) $(OBFUS_DIR); $(java-vm-cleanup)
+	@#
 	@# The sun.security.internal classes are currently not obfuscated
 	@# due to an obfus problem. Manually copy them to the build directory
 	@# so that they are included in the jce.jar file.
+	@#
 	$(CP) -r $(CLASSDESTDIR)/sun $(OBFUS_DIR)/build
-	$(RM) $(UNSIGNED_DIR)/jce.jar
 	$(BOOT_JAR_CMD) cmf $(JCE_MANIFEST_FILE) $@	\
 	    -C $(OBFUS_DIR)/build javax			\
 	    -C $(OBFUS_DIR)/build sun			\
 	    $(JAR_JFLAGS)
 	$(sign-target)
-	$(MKDIR) -p $(dir $(JAR_DESTFILE))
-	$(RM) $(JAR_DESTFILE)
-	$(CP) $@ $(JAR_DESTFILE)
 	@$(java-vm-cleanup)
 
+$(OBFUS_DIR)/framework.dox: $(CLOSED_DIR)/obfus/framework.dox
+	@$(ECHO) ">>>Creating framework.dox"
+	$(prep-target)
+	$(SED) "s:@@TEMPDIR@@:$(ABS_TEMPDIR):" $< > $@
+
 #
 # The current obfuscator has a limitation in that it currently only
 # supports up to v49 class file format.  Force v49 classfiles in our
@@ -380,26 +424,27 @@
 # unlimited policy file distribution, etc.
 #
 
-release: $(OBFUS_DIR)/jce.jar sign-policy
+release: $(OBFUS_DIR)/jce.jar sign-policy $(CLOSED_DIR)/doc/COPYRIGHT.html \
+         $(CLOSED_DIR)/doc/README.txt
 	$(RM) -r \
-	    $(RELEASE_DIR)/UnlimitedJCEPolicy \
-	    $(RELEASE_DIR)/jce.jar \
-	    $(RELEASE_DIR)/US_export_policy.jar \
-	    $(RELEASE_DIR)/local_policy.jar \
-	    $(RELEASE_DIR)/UnlimitedJCEPolicy.zip
-	$(MKDIR) -p $(RELEASE_DIR)/UnlimitedJCEPolicy
-	$(CP) $(OBFUS_DIR)/jce.jar $(RELEASE_DIR)
-	$(CP) -r \
-	    $(SIGNED_POLICY_BUILDDIR)/limited/US_export_policy.jar \
-	    $(SIGNED_POLICY_BUILDDIR)/limited/local_policy.jar \
-	    $(RELEASE_DIR)
+	    $(JCE_BUILD_DIR)/release/UnlimitedJCEPolicy              \
+	    $(JCE_BUILD_DIR)/release/jce.jar                         \
+	    $(JCE_BUILD_DIR)/release/US_export_policy.jar            \
+	    $(JCE_BUILD_DIR)/release/local_policy.jar                \
+	    $(JCE_BUILD_DIR)/release/UnlimitedJCEPolicy.zip
+	$(MKDIR) -p $(JCE_BUILD_DIR)/release/UnlimitedJCEPolicy
+	$(CP) $(OBFUS_DIR)/jce.jar $(JCE_BUILD_DIR)/release
+	$(CP) \
+	    $(SIGNED_POLICY_BUILDDIR)/limited/US_export_policy.jar   \
+	    $(SIGNED_POLICY_BUILDDIR)/limited/local_policy.jar       \
+	    $(JCE_BUILD_DIR)/release
 	$(CP) \
 	    $(SIGNED_POLICY_BUILDDIR)/unlimited/US_export_policy.jar \
-	    $(SIGNED_POLICY_BUILDDIR)/unlimited/local_policy.jar \
-	    $(RELEASE_DIR)/UnlimitedJCEPolicy
-	$(CP) $(CLOSED_DIR)/doc/COPYRIGHT.html \
-	    $(CLOSED_DIR)/doc/README.txt $(RELEASE_DIR)/UnlimitedJCEPolicy
-	cd $(RELEASE_DIR) ; \
+	    $(SIGNED_POLICY_BUILDDIR)/unlimited/local_policy.jar     \
+	    $(CLOSED_DIR)/doc/COPYRIGHT.html                         \
+	    $(CLOSED_DIR)/doc/README.txt                             \
+	    $(JCE_BUILD_DIR)/release/UnlimitedJCEPolicy
+	cd $(JCE_BUILD_DIR)/release ; \
 	$(ZIPEXE) -qr UnlimitedJCEPolicy.zip UnlimitedJCEPolicy
 	$(release-warning)
 
@@ -478,7 +523,8 @@
 
 clobber clean::
 	$(RM) -r $(JAR_DESTFILE) $(POLICY_DESTDIR)/US_export_policy.jar \
-	    $(POLICY_DESTDIR)/local_policy.jar $(DELETE_DIRS) $(TEMPDIR)
+	    $(POLICY_DESTDIR)/local_policy.jar $(DELETE_DIRS) $(TEMPDIR) \
+	    $(JCE_BUILD_DIR)
 
 .PHONY: build-jar jar build-policy unlimited limited install-jar \
 	install-limited install-unlimited

--- a/jdk/make/sun/security/mscapi/Makefile	Wed Apr 02 22:44:45 2008 -0400
+++ b/jdk/make/sun/security/mscapi/Makefile	Sun Apr 06 10:15:03 2008 -0700
@@ -1,5 +1,5 @@
 #
-# Copyright 2005-2007 Sun Microsystems, Inc.  All Rights Reserved.
+# Copyright 2005-2008 Sun Microsystems, Inc.  All Rights Reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -92,8 +92,25 @@
 PACKAGE = sun.security.mscapi
 LIBRARY = sunmscapi
 PRODUCT = sun
+
+#
+# The following is for when we need to do postprocessing
+# (signing/obfuscation) against a read-only build.  If the OUTPUTDIR
+# isn't writable, the build currently crashes out.
+#
+ifndef OPENJDK
+  ifdef ALT_JCE_BUILD_DIR
+    # =====================================================
+    # Where to place the output, in case we're building from a read-only
+    # build area.  (e.g. a release engineering build.)
+    JCE_BUILD_DIR=${ALT_JCE_BUILD_DIR}
+    IGNORE_WRITABLE_OUTPUTDIR_TEST=true
+  else
+    JCE_BUILD_DIR=${TEMPDIR}
+  endif
+endif
+
 include $(BUILDDIR)/common/Defs.gmk
-include $(BUILDDIR)/javax/crypto/Defs-jce.gmk
 
 CPLUSPLUSLIBRARY=true
 
@@ -163,6 +180,8 @@
 	$(build-warning)
 endif
 
+include $(BUILDDIR)/javax/crypto/Defs-jce.gmk
+
 
 # =====================================================
 # Build the unsigned sunmscapi.jar file.
@@ -200,14 +219,26 @@
 # Sign the provider jar file.  Not needed for OpenJDK.
 #
 
-SIGNED_DIR = $(TEMPDIR)/signed
+SIGNED_DIR = $(JCE_BUILD_DIR)/signed
 
 sign: sign-jar
 
 sign-jar: $(SIGNED_DIR)/sunmscapi.jar
 
+ifndef ALT_JCE_BUILD_DIR
 $(SIGNED_DIR)/sunmscapi.jar: $(UNSIGNED_DIR)/sunmscapi.jar
-	$(sign-file)
+else
+#
+# We have to remove the build dependency, otherwise, we'll try to rebuild it
+# which we can't do on a read-only filesystem.
+#
+$(SIGNED_DIR)/sunmscapi.jar:
+	@if [ ! -r $(UNSIGNED_DIR)/sunmscapi.jar ] ; then \
+	    $(ECHO) "Couldn't find $(UNSIGNED_DIR)/sunmscapi.jar"; \
+	    exit 1; \
+	fi
+endif
+	$(call sign-file, $(UNSIGNED_DIR)/sunmscapi.jar)
 
 
 # =====================================================
@@ -215,9 +246,9 @@
 #
 
 release: $(SIGNED_DIR)/sunmscapi.jar
-	$(RM) $(RELEASE_DIR)/sunmscapi.jar
-	$(MKDIR) -p $(RELEASE_DIR)
-	$(CP) $(SIGNED_DIR)/sunmscapi.jar $(RELEASE_DIR)
+	$(RM) $(JCE_BUILD_DIR)/release/sunmscapi.jar
+	$(MKDIR) -p $(JCE_BUILD_DIR)/release
+	$(CP) $(SIGNED_DIR)/sunmscapi.jar $(JCE_BUILD_DIR)/release
 	$(release-warning)
 
 endif # OPENJDK
@@ -255,7 +286,7 @@
 #
 
 clobber clean::
-	$(RM) -r $(JAR_DESTFILE) $(TEMPDIR)
+	$(RM) -r $(JAR_DESTFILE) $(TEMPDIR) $(JCE_BUILD_DIR)
 
 .PHONY: build-jar jar install-jar
 ifndef OPENJDK

--- a/jdk/make/sun/security/pkcs11/Makefile	Wed Apr 02 22:44:45 2008 -0400
+++ b/jdk/make/sun/security/pkcs11/Makefile	Sun Apr 06 10:15:03 2008 -0700
@@ -1,5 +1,5 @@
 #
-# Copyright 2003-2007 Sun Microsystems, Inc.  All Rights Reserved.
+# Copyright 2003-2008 Sun Microsystems, Inc.  All Rights Reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -92,8 +92,25 @@
 PACKAGE = sun.security.pkcs11
 LIBRARY = j2pkcs11
 PRODUCT = sun
+
+#
+# The following is for when we need to do postprocessing
+# (signing/obfuscation) against a read-only build.  If the OUTPUTDIR
+# isn't writable, the build currently crashes out.
+#
+ifndef OPENJDK
+  ifdef ALT_JCE_BUILD_DIR
+    # =====================================================
+    # Where to place the output, in case we're building from a read-only
+    # build area.  (e.g. a release engineering build.)
+    JCE_BUILD_DIR=${ALT_JCE_BUILD_DIR}
+    IGNORE_WRITABLE_OUTPUTDIR_TEST=true
+  else
+    JCE_BUILD_DIR=${TEMPDIR}
+  endif
+endif
+
 include $(BUILDDIR)/common/Defs.gmk
-include $(BUILDDIR)/javax/crypto/Defs-jce.gmk
 
 #
 # C and Java Files
@@ -163,6 +180,8 @@
 	$(build-warning)
 endif
 
+include $(BUILDDIR)/javax/crypto/Defs-jce.gmk
+
 
 # =====================================================
 # Build the unsigned sunpkcs11.jar file.
@@ -200,14 +219,26 @@
 # Sign the provider jar file.  Not needed for OpenJDK.
 #
 
-SIGNED_DIR = $(TEMPDIR)/signed
+SIGNED_DIR = $(JCE_BUILD_DIR)/signed
 
 sign: sign-jar
 
 sign-jar: $(SIGNED_DIR)/sunpkcs11.jar
 
+ifndef ALT_JCE_BUILD_DIR
 $(SIGNED_DIR)/sunpkcs11.jar: $(UNSIGNED_DIR)/sunpkcs11.jar
-	$(sign-file)
+else
+#
+# We have to remove the build dependency, otherwise, we'll try to rebuild it
+# which we can't do on a read-only filesystem.
+#
+$(SIGNED_DIR)/sunpkcs11.jar:
+	@if [ ! -r $(UNSIGNED_DIR)/sunpkcs11.jar ] ; then \
+            $(ECHO) "Couldn't find $(UNSIGNED_DIR)/sunpkcs11.jar"; \
+            exit 1; \
+        fi
+endif
+	$(call sign-file, $(UNSIGNED_DIR)/sunpkcs11.jar)
 
 
 # =====================================================
@@ -215,9 +246,9 @@
 #
 
 release: $(SIGNED_DIR)/sunpkcs11.jar
-	$(RM) $(RELEASE_DIR)/sunpkcs11.jar
-	$(MKDIR) -p $(RELEASE_DIR)
-	$(CP) $(SIGNED_DIR)/sunpkcs11.jar $(RELEASE_DIR)
+	$(RM) $(JCE_BUILD_DIR)/release/sunpkcs11.jar
+	$(MKDIR) -p $(JCE_BUILD_DIR)/release
+	$(CP) $(SIGNED_DIR)/sunpkcs11.jar $(JCE_BUILD_DIR)/release
 	$(release-warning)
 
 endif # OPENJDK
@@ -255,7 +286,7 @@
 #
 
 clobber clean::
-	$(RM) -r $(JAR_DESTFILE) $(TEMPDIR)
+	$(RM) -r $(JAR_DESTFILE) $(TEMPDIR) $(JCE_BUILD_DIR)
 
 .PHONY: build-jar jar install-jar
 ifndef OPENJDK