--- a/src/brand/attach	Wed Dec 02 11:01:27 2009 -0800
+++ b/src/brand/attach	Wed Dec 02 14:56:24 2009 -0700
@@ -53,6 +53,7 @@
 f_zone_entire=$(gettext "Could not find 'entire' incorporation for non-global zone.")
 f_fmri_compare=$(gettext "Failed to compare 'entire' FMRIs")
 f_reset_pub=$(gettext "Failed to reset publisher to %s %s")
+f_del_pub=$(gettext "Failed to unset publisher '%s' for zone.")
 f_no_pref_publisher=$(gettext "Unable to get preferred publisher information for zone '%s'.")
 f_pkg_list=$(gettext "Unable to get zone package list.")
 f_get_secinfo=$(gettext "Failed to get key/cert information for publisher %s")
@@ -430,10 +431,12 @@
 	# Be certain that the global zone preferred publisher exists in
 	# the non-global zone.  If it doesn't, all of these comparisons
 	# are not valid.
+	del_ngz_pub=0
 	if [[ -n "$zone_publisher" && "$zone_publisher" != "$gz_publisher" ]];
 	then
 		zone_publisher_origins=""
 		zone_publisher_mirrors=""
+		del_ngz_pub=1
 	fi
 
 	# Add any origins not found in zone configuration.
@@ -481,6 +484,13 @@
 		fatal "$f_reset_pub" $gz_publisher \
 		    "$gz_publisher_origins $gz_publisher_mirrors"
 	fi
+
+	# If the original preferred non-global zone publisher has the 
+	# same URI as the global zone publisher we just stuck into the zone,
+	# then we now need to delete the old ngz publisher.
+	(( $del_ngz_pub == 1 )) && ( $PKG unset-publisher $zone_publisher || \
+	    fatal "$f_del_pub" $zone_publisher )
+
 	zone_publisher=$gz_publisher
 	zone_publisher_origins=$gz_publisher_origins
 	zone_publisher_mirrors=$gz_publisher_mirrors
@@ -501,10 +511,7 @@
 # some updates-- particularly on a respin of a package (say, where only
 # the datestamps change).
 #
-$PKG install $gz_entire_fmri
-if [ $? -ne 0 ]; then
-	fatal "$f_update"
-fi
+$PKG install $gz_entire_fmri || pkg_err_check "$f_update"
 
 printf "$m_updating2\n"
 #
@@ -521,10 +528,7 @@
 	fatal "$f_pkg_list"
 fi
 
-$PKG install $zone_pkgs
-if [ $? -ne 0 ]; then
-	fatal "$f_update"
-fi
+$PKG install $zone_pkgs || pkg_err_check "$f_update"
 
 printf "$m_sync_done\n" $gz_entire_fmri
 printf "$m_complete\n"

--- a/src/brand/common.ksh	Wed Dec 02 11:01:27 2009 -0800
+++ b/src/brand/common.ksh	Wed Dec 02 14:56:24 2009 -0700
@@ -376,3 +376,12 @@
 	    nawk -F': ' '/SSL Cert/ {print $2; exit 0}')
 	print $key $cert
 }
+
+#
+# Handle pkg exit code.  Exit 0 means Command succeeded, exit 4 means
+# No changes were made - nothing to do.  Any other exit code is an error.
+#
+pkg_err_check() {
+	res=$?
+	(( $res != 0 && $res != 4 )) && fail_fatal "$1"
+}

--- a/src/brand/pkgcreatezone	Wed Dec 02 11:01:27 2009 -0800
+++ b/src/brand/pkgcreatezone	Wed Dec 02 14:56:24 2009 -0700
@@ -463,9 +463,9 @@
 # work.  This can all hopefully go away once "primordial" actions
 # arrive.
 #
-$PKG install -q --no-refresh --no-index $entire_fmri || fail_fatal "$f_pkg"
-$PKG install -q --no-refresh --no-index SUNWcsd || fail_fatal "$f_pkg"
-$PKG install --no-refresh --no-index SUNWcs || fail_fatal "$f_pkg"
+$PKG install -q --no-refresh --no-index $entire_fmri || pkg_err_check "$f_pkg"
+$PKG install --no-refresh --no-index SUNWcsd || pkg_err_check "$f_pkg"
+$PKG install --no-refresh --no-index SUNWcs || pkg_err_check "$f_pkg"
 
 printf "$m_more\n"
 pkglist=""
@@ -525,7 +525,7 @@
 # Do the install; we just refreshed on image-create, so skip that.  We
 # also skip indexing here, as that is also what the LiveCD does.
 #
-$PKG install --no-index --no-refresh $pkglist || fail_fatal "$f_pkg"
+$PKG install --no-index --no-refresh $pkglist || pkg_err_check "$f_pkg"
 
 printf "\n$m_mannote\n"