Merge "Revert "Revert "Enable `-sha256` feature to some Soong built zip files"""
diff --git a/core/Makefile b/core/Makefile
index a150ee4..9b3e3d9 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -181,6 +181,7 @@
 
 ifeq ($(HOST_OS),linux)
 $(call dist-for-goals,sdk,$(API_FINGERPRINT))
+$(call dist-for-goals,droidcore,$(API_FINGERPRINT))
 endif
 
 INSTALLED_RECOVERYIMAGE_TARGET :=
@@ -508,6 +509,15 @@
 endef
 
 # $(1): kernel module directory name (top is an out of band value for no directory)
+define build-vendor-kernel-ramdisk-recovery-load
+$(if $(filter top,$(1)),\
+  $(eval _kver :=)$(eval _sep :=),\
+  $(eval _kver := $(1))$(eval _sep :=_))\
+  $(if $(BOARD_VENDOR_KERNEL_RAMDISK_RECOVERY_KERNEL_MODULES_LOAD$(_sep)$(_kver)),\
+    $(call copy-many-files,$(call module-load-list-copy-paths,$(call intermediates-dir-for,PACKAGING,vendor_kernel_ramdisk_recovery_module_list$(_sep)$(_kver)),$(BOARD_VENDOR_KERNEL_RAMDISK_KERNEL_MODULES$(_sep)$(_kver)),$(BOARD_VENDOR_KERNEL_RAMDISK_RECOVERY_KERNEL_MODULES_LOAD$(_sep)$(_kver)),modules.load.recovery,$(TARGET_VENDOR_KERNEL_RAMDISK_OUT))))
+endef
+
+# $(1): kernel module directory name (top is an out of band value for no directory)
 define build-vendor-charger-load
 $(if $(filter top,$(1)),\
   $(eval _kver :=)$(eval _sep :=),\
@@ -578,6 +588,7 @@
   $(eval $(result_var) += $(call build-image-kernel-modules-dir,VENDOR_RAMDISK,$(output_dir),,modules.load,$(VENDOR_RAMDISK_STRIPPED_MODULE_STAGING_DIR),$(kmd))) \
   $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,VENDOR_KERNEL_RAMDISK,$(TARGET_VENDOR_KERNEL_RAMDISK_OUT),,modules.load,$(VENDOR_KERNEL_RAMDISK_STRIPPED_MODULE_STAGING_DIR),$(kmd))) \
   $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-vendor-ramdisk-recovery-load,$(kmd))) \
+  $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-vendor-kernel-ramdisk-recovery-load,$(kmd))) \
   $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,VENDOR,$(if $(filter true,$(BOARD_USES_VENDOR_DLKMIMAGE)),$(TARGET_OUT_VENDOR_DLKM),$(TARGET_OUT_VENDOR)),vendor,modules.load,$(VENDOR_STRIPPED_MODULE_STAGING_DIR),$(kmd),$(BOARD_SYSTEM_KERNEL_MODULES),system)) \
   $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-vendor-charger-load,$(kmd))) \
   $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,ODM,$(if $(filter true,$(BOARD_USES_ODM_DLKMIMAGE)),$(TARGET_OUT_ODM_DLKM),$(TARGET_OUT_ODM)),odm,modules.load,,$(kmd))) \
@@ -586,6 +597,19 @@
     $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-recovery-as-boot-load,$(kmd))),\
     $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,GENERIC_RAMDISK,$(TARGET_RAMDISK_OUT),,modules.load,,$(kmd)))))
 
+ifeq ($(BOARD_SYSTEM_KERNEL_MODULES),)
+ifneq ($(BOARD_SYSTEM_DLKM_SRC),)
+ifneq ($(wildcard $(BOARD_SYSTEM_DLKM_SRC)/*),)
+  SYSTEM_KERNEL_MODULES := $(shell find $(BOARD_SYSTEM_DLKM_SRC) -type f)
+  SRC_SYSTEM_KERNEL_MODULES := $(SYSTEM_KERNEL_MODULES)
+  DST_SYSTEM_KERNEL_MODULES := $(patsubst $(BOARD_SYSTEM_DLKM_SRC)/%,:$(TARGET_OUT_SYSTEM_DLKM)/%,$(SRC_SYSTEM_KERNEL_MODULES))
+  SYSTEM_KERNEL_MODULE_COPY_PAIRS := $(join $(SRC_SYSTEM_KERNEL_MODULES),$(DST_SYSTEM_KERNEL_MODULES))
+  ALL_DEFAULT_INSTALLED_MODULES += $(call copy-many-files,$(SYSTEM_KERNEL_MODULE_COPY_PAIRS))
+endif
+endif
+endif
+
+
 # -----------------------------------------------------------------
 # Cert-to-package mapping.  Used by the post-build signing tools.
 # Use a macro to add newline to each echo command
@@ -918,16 +942,19 @@
 RAMDISK_EXT := .gz
 endif
 
+# This file contains /dev nodes description added to the generic ramdisk
+RAMDISK_NODE_LIST := $(PRODUCT_OUT)/ramdisk_node_list
+
 # We just build this directly to the install location.
 INSTALLED_RAMDISK_TARGET := $(BUILT_RAMDISK_TARGET)
 $(INSTALLED_RAMDISK_TARGET): PRIVATE_DIRS := debug_ramdisk dev metadata mnt proc second_stage_resources sys
-$(INSTALLED_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_RAMDISK_FILES) $(INSTALLED_FILES_FILE_RAMDISK) | $(COMPRESSION_COMMAND_DEPS)
+$(INSTALLED_RAMDISK_TARGET): $(MKBOOTFS) $(RAMDISK_NODE_LIST) $(INTERNAL_RAMDISK_FILES) $(INSTALLED_FILES_FILE_RAMDISK) | $(COMPRESSION_COMMAND_DEPS)
 	$(call pretty,"Target ramdisk: $@")
 	$(hide) mkdir -p $(addprefix $(TARGET_RAMDISK_OUT)/,$(PRIVATE_DIRS))
 ifeq (true,$(BOARD_USES_GENERIC_KERNEL_IMAGE))
 	$(hide) mkdir -p $(addprefix $(TARGET_RAMDISK_OUT)/first_stage_ramdisk/,$(PRIVATE_DIRS))
 endif
-	$(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RAMDISK_OUT) | $(COMPRESSION_COMMAND) > $@
+	$(hide) $(MKBOOTFS) -n $(RAMDISK_NODE_LIST) -d $(TARGET_OUT) $(TARGET_RAMDISK_OUT) | $(COMPRESSION_COMMAND) > $@
 
 $(call declare-1p-container,$(INSTALLED_RAMDISK_TARGET),)
 $(call declare-container-license-deps,$(INSTALLED_RAMDISK_TARGET),$(INTERNAL_RAMDISK_FILE),$(PRODUCT_OUT)/:/)
@@ -1262,7 +1289,7 @@
 	$(AVBTOOL) add_hash_footer \
 	    --image $@ \
 	    $(call get-partition-size-argument,$(BOARD_INIT_BOOT_IMAGE_PARTITION_SIZE)) \
-	    --partition_name boot $(INTERNAL_AVB_INIT_BOOT_SIGNING_ARGS) \
+	    --partition_name init_boot $(INTERNAL_AVB_INIT_BOOT_SIGNING_ARGS) \
 	    $(BOARD_AVB_INIT_BOOT_ADD_HASH_FOOTER_ARGS)
 
 $(call declare-1p-container,$(INSTALLED_INIT_BOOT_IMAGE_TARGET),)
@@ -4576,6 +4603,7 @@
 $(INSTALLED_VBMETAIMAGE_TARGET): PRIVATE_AVB_VBMETA_SIGNING_ARGS := \
     --algorithm $(BOARD_AVB_ALGORITHM) --key $(BOARD_AVB_KEY_PATH)
 
+
 $(INSTALLED_VBMETAIMAGE_TARGET): \
 	    $(AVBTOOL) \
 	    $(INSTALLED_BOOTIMAGE_TARGET) \
@@ -4596,10 +4624,10 @@
 	    $(INSTALLED_RECOVERYIMAGE_TARGET) \
 	    $(INSTALLED_VBMETA_SYSTEMIMAGE_TARGET) \
 	    $(INSTALLED_VBMETA_VENDORIMAGE_TARGET) \
-      $(foreach partition,$(call to-upper,$( BOARD_AVB_VBMETA_CUSTOM_PARTITIONS)),$(INSTALLED_VBMETA_$(partition)IMAGE_TARGET)) \
+      $(foreach partition,$(call to-upper,$(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS)),$(INSTALLED_VBMETA_$(partition)IMAGE_TARGET)) \
 	    $(BOARD_AVB_VBMETA_SYSTEM_KEY_PATH) \
 	    $(BOARD_AVB_VBMETA_VENDOR_KEY_PATH) \
-      $(foreach partition,$(call to-upper,$( BOARD_AVB_VBMETA_CUSTOM_PARTITIONS)),$(BOARD_AVB_VBMETA_$(partition)_KEY_PATH)) \
+      $(foreach partition,$(call to-upper,$(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS)),$(BOARD_AVB_VBMETA_$(partition)_KEY_PATH)) \
 	    $(BOARD_AVB_KEY_PATH)
 	$(build-vbmetaimage-target)
 
@@ -5059,6 +5087,7 @@
   img2simg \
   img_from_target_files \
   imgdiff \
+  initrd_bootconfig \
   libconscrypt_openjdk_jni \
   lpmake \
   lpunpack \
@@ -5104,7 +5133,7 @@
 INTERNAL_OTATOOLS_MODULES += \
   apexer \
   apex_compression_tool \
-  blkid \
+  blkid_static \
   deapexer \
   debugfs_static \
   dump_apex_info \
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 18730aa..ec5a21e 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -716,6 +716,15 @@
 ## Compatibility suite files.
 ###########################################################
 ifdef LOCAL_COMPATIBILITY_SUITE
+
+ifneq (,$(LOCAL_FULL_TEST_CONFIG))
+  test_config := $(LOCAL_FULL_TEST_CONFIG)
+else ifneq (,$(LOCAL_TEST_CONFIG))
+  test_config := $(LOCAL_PATH)/$(LOCAL_TEST_CONFIG)
+else
+  test_config := $(wildcard $(LOCAL_PATH)/AndroidTest.xml)
+endif
+
 ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
 
 # If we are building a native test or benchmark and its stem variants are not defined,
@@ -762,13 +771,6 @@
 
 
 # Auto-generate build config.
-ifneq (,$(LOCAL_FULL_TEST_CONFIG))
-  test_config := $(LOCAL_FULL_TEST_CONFIG)
-else ifneq (,$(LOCAL_TEST_CONFIG))
-  test_config := $(LOCAL_PATH)/$(LOCAL_TEST_CONFIG)
-else
-  test_config := $(wildcard $(LOCAL_PATH)/AndroidTest.xml)
-endif
 ifeq (,$(test_config))
   ifneq (true,$(is_native))
     is_instrumentation_test := true
@@ -847,16 +849,6 @@
   endif
 endif # $(my_prefix)$(LOCAL_MODULE_CLASS)_$(LOCAL_MODULE)_compat_files
 
-# HACK: pretend a soong LOCAL_FULL_TEST_CONFIG is autogenerated by setting the flag in
-# module-info.json
-# TODO: (b/113029686) Add explicit flag from Soong to determine if a test was
-# autogenerated.
-ifneq (,$(filter $(SOONG_OUT_DIR)%,$(LOCAL_FULL_TEST_CONFIG)))
-  ifeq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
-    ALL_MODULES.$(my_register_name).auto_test_config := true
-  endif
-endif
-
 
 ifeq ($(use_testcase_folder),true)
 ifneq ($(my_test_data_file_pairs),)
@@ -897,6 +889,17 @@
   $(eval my_compat_dist_test_data_$(suite) := ))
 
 endif  # LOCAL_UNINSTALLABLE_MODULE
+
+# HACK: pretend a soong LOCAL_FULL_TEST_CONFIG is autogenerated by setting the flag in
+# module-info.json
+# TODO: (b/113029686) Add explicit flag from Soong to determine if a test was
+# autogenerated.
+ifneq (,$(filter $(SOONG_OUT_DIR)%,$(LOCAL_FULL_TEST_CONFIG)))
+  ifeq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+    ALL_MODULES.$(my_register_name).auto_test_config := true
+  endif
+endif
+
 endif  # LOCAL_COMPATIBILITY_SUITE
 
 my_supported_variant :=
diff --git a/core/binary.mk b/core/binary.mk
index 6320726..6f1d814 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -58,6 +58,9 @@
 my_cppflags := $(LOCAL_CPPFLAGS)
 my_cflags_no_override := $(GLOBAL_CLANG_CFLAGS_NO_OVERRIDE)
 my_cppflags_no_override := $(GLOBAL_CLANG_CPPFLAGS_NO_OVERRIDE)
+ifeq ($(my_32_64_bit_suffix), 64)
+  my_cflags_no_override += $(GLOBAL_CLANG_CFLAGS_64_NO_OVERRIDE)
+endif
 ifdef is_third_party
     my_cflags_no_override += $(GLOBAL_CLANG_EXTERNAL_CFLAGS_NO_OVERRIDE)
     my_cppflags_no_override += $(GLOBAL_CLANG_EXTERNAL_CFLAGS_NO_OVERRIDE)
diff --git a/core/clang/config.mk b/core/clang/config.mk
index 28a75ec..d03c541 100644
--- a/core/clang/config.mk
+++ b/core/clang/config.mk
@@ -2,7 +2,7 @@
 
 LLVM_READOBJ := $(LLVM_PREBUILTS_BASE)/$(BUILD_OS)-x86/$(LLVM_PREBUILTS_VERSION)/bin/llvm-readobj
 
-LLVM_RTLIB_PATH := $(LLVM_PREBUILTS_BASE)/linux-x86/$(LLVM_PREBUILTS_VERSION)/lib64/clang/$(LLVM_RELEASE_VERSION)/lib/linux/
+LLVM_RTLIB_PATH := $(LLVM_PREBUILTS_BASE)/linux-x86/$(LLVM_PREBUILTS_VERSION)/lib/clang/$(LLVM_RELEASE_VERSION)/lib/linux/
 
 define convert-to-clang-flags
 $(strip $(filter-out $(CLANG_CONFIG_UNKNOWN_CFLAGS),$(1)))
diff --git a/core/config.mk b/core/config.mk
index f5bb7ef..025a3a1 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -431,6 +431,9 @@
 $(hide) $(HOST_NM) -gP $(1) | cut -f1-2 -d" " | (grep -v U$$ >> $(2) || true)
 endef
 
+# Pick a Java compiler.
+include $(BUILD_SYSTEM)/combo/javac.mk
+
 ifeq ($(CALLED_FROM_SETUP),true)
 include $(BUILD_SYSTEM)/ccache.mk
 include $(BUILD_SYSTEM)/goma.mk
@@ -453,9 +456,6 @@
   WITH_TIDY_ONLY :=
 endif
 
-# Pick a Java compiler.
-include $(BUILD_SYSTEM)/combo/javac.mk
-
 # ---------------------------------------------------------------
 # Check that the configuration is current.  We check that
 # BUILD_ENV_SEQUENCE_NUMBER is current against this value.
diff --git a/core/product.mk b/core/product.mk
index 3b22314..f4d5a4f 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -24,6 +24,8 @@
 
 _product_single_value_vars += PRODUCT_NAME
 _product_single_value_vars += PRODUCT_MODEL
+_product_single_value_vars += PRODUCT_NAME_FOR_ATTESTATION
+_product_single_value_vars += PRODUCT_MODEL_FOR_ATTESTATION
 
 # The resoure configuration options to use for this product.
 _product_list_vars += PRODUCT_LOCALES
@@ -43,6 +45,7 @@
 _product_single_value_vars += PRODUCT_DEVICE
 _product_single_value_vars += PRODUCT_MANUFACTURER
 _product_single_value_vars += PRODUCT_BRAND
+_product_single_value_vars += PRODUCT_BRAND_FOR_ATTESTATION
 
 # These PRODUCT_SYSTEM_* flags, if defined, are used in place of the
 # corresponding PRODUCT_* flags for the sysprops on /system.
diff --git a/core/product_config.rbc b/core/product_config.rbc
index da8209b..97c1d00 100644
--- a/core/product_config.rbc
+++ b/core/product_config.rbc
@@ -462,6 +462,9 @@
 
 def __words(string_or_list):
     if type(string_or_list) == "list":
+        for x in string_or_list:
+            if type(x) != "string":
+                return string_or_list
         string_or_list = " ".join(string_or_list)
     return _mkstrip(string_or_list).split()
 
diff --git a/core/proguard.flags b/core/proguard.flags
index 53f63d8..d790061 100644
--- a/core/proguard.flags
+++ b/core/proguard.flags
@@ -9,14 +9,19 @@
 # Add this flag in your package's own configuration if it's needed.
 #-flattenpackagehierarchy
 
-# Keep classes and methods that have @VisibleForTesting annotations, except in
-# intermediate libraries that export those annotations (e.g., androidx, guava).
-# This avoids keeping library-specific test code that isn't actually needed
-# for platform testing.
+# Keep classes and members with the platform-defined @VisibleForTesting annotation.
+-keep @com.android.internal.annotations.VisibleForTesting class *
+-keepclassmembers class * {
+    @com.android.internal.annotations.VisibleForTesting *;
+}
+
+# Keep classes and members with non-platform @VisibleForTesting annotations, but
+# only within platform-defined packages. This avoids keeping external, library-specific
+# test code that isn't actually needed for platform testing.
 # TODO(b/239961360): Migrate away from androidx.annotation.VisibleForTesting
 # and com.google.common.annotations.VisibleForTesting use in platform code.
--keep @**.VisibleForTesting class !androidx.**,!com.google.common.**,*
--keepclassmembers class !androidx.**,!com.google.common.**,* {
+-keep @**.VisibleForTesting class android.**,com.android.**,com.google.android.**
+-keepclassmembers class android.**,com.android.**,com.google.android.** {
     @**.VisibleForTesting *;
 }
 
diff --git a/core/rbe.mk b/core/rbe.mk
index 65abde5..6754b0a 100644
--- a/core/rbe.mk
+++ b/core/rbe.mk
@@ -81,11 +81,11 @@
   endif
 
   ifdef RBE_R8
-    R8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=r8 --exec_strategy=$(r8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=$(OUT_DIR)/soong/host/linux-x86/framework/r8-compat-proguard.jar,build/make/core/proguard_basic_keeps.flags --toolchain_inputs=$(JAVA))
+    R8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=r8 --exec_strategy=$(r8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=$(OUT_DIR)/host/linux-x86/framework/r8.jar,build/make/core/proguard_basic_keeps.flags --toolchain_inputs=$(firstword $(JAVA)))
   endif
 
   ifdef RBE_D8
-    D8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=d8 --exec_strategy=$(d8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=$(OUT_DIR)/soong/host/linux-x86/framework/d8.jar --toolchain_inputs=$(JAVA))
+    D8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=d8 --exec_strategy=$(d8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=$(OUT_DIR)/host/linux-x86/framework/d8.jar --toolchain_inputs=$(firstword $(JAVA)))
   endif
 
   rbe_dir :=
diff --git a/core/soong_config.mk b/core/soong_config.mk
index e6c4d64..091fa34 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -266,6 +266,10 @@
 
 $(call add_json_bool, CompressedApex, $(filter true,$(PRODUCT_COMPRESSED_APEX)))
 
+ifndef APEX_BUILD_FOR_PRE_S_DEVICES
+$(call add_json_bool, TrimmedApex, $(filter true,$(PRODUCT_TRIMMED_APEX)))
+endif
+
 $(call add_json_bool, BoardUsesRecoveryAsBoot, $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)))
 
 $(call add_json_list, BoardKernelBinaries, $(BOARD_KERNEL_BINARIES))
diff --git a/core/sysprop.mk b/core/sysprop.mk
index b51818a..b7f0651 100644
--- a/core/sysprop.mk
+++ b/core/sysprop.mk
@@ -46,6 +46,10 @@
         echo "ro.product.$(1).manufacturer=$(PRODUCT_MANUFACTURER)" >> $(2);\
         echo "ro.product.$(1).model=$(PRODUCT_MODEL)" >> $(2);\
         echo "ro.product.$(1).name=$(TARGET_PRODUCT)" >> $(2);\
+        # Attestation specific properties for AOSP/GSI build running on device.
+        echo "ro.product.model_for_attestation=$(PRODUCT_MODEL_FOR_ATTESTATION)" >> $(2);\
+        echo "ro.product.brand_for_attestation=$(PRODUCT_BRAND_FOR_ATTESTATION)" >> $(2);\
+        echo "ro.product.name_for_attestation=$(PRODUCT_NAME_FOR_ATTESTATION)" >> $(2);\
     )\
     $(if $(filter true,$(ZYGOTE_FORCE_64)),\
         $(if $(filter vendor,$(1)),\
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index e6a96ff..a664b9d 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -103,7 +103,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-    PLATFORM_SECURITY_PATCH := 2023-01-05
+    PLATFORM_SECURITY_PATCH := 2023-02-05
 endif
 
 include $(BUILD_SYSTEM)/version_util.mk
diff --git a/envsetup.sh b/envsetup.sh
index a30f6bd..0272624 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -79,6 +79,7 @@
 - ggrep:      Greps on all local Gradle files.
 - gogrep:     Greps on all local Go files.
 - jgrep:      Greps on all local Java files.
+- jsongrep:   Greps on all local Json files.
 - ktgrep:     Greps on all local Kotlin files.
 - resgrep:    Greps on all local res/*.xml files.
 - mangrep:    Greps on all local AndroidManifest.xml files.
@@ -87,6 +88,7 @@
 - rsgrep:     Greps on all local Rust files.
 - sepgrep:    Greps on all local sepolicy files.
 - sgrep:      Greps on all local source files.
+- tomlgrep:   Greps on all local Toml files.
 - pygrep:     Greps on all local Python files.
 - godir:      Go to the directory containing a file.
 - allmod:     List all modules.
@@ -295,7 +297,22 @@
     if [ -n $ANDROID_PYTHONPATH ]; then
         export PYTHONPATH=${PYTHONPATH//$ANDROID_PYTHONPATH/}
     fi
-    export ANDROID_PYTHONPATH=$T/development/python-packages:
+    # //development/python-packages contains both a pseudo-PYTHONPATH which
+    # mimics an already assembled venv, but also contains real Python packages
+    # that are not in that layout until they are installed. We can fake it for
+    # the latter type by adding the package source directories to the PYTHONPATH
+    # directly. For the former group, we only need to add the python-packages
+    # directory itself.
+    #
+    # This could be cleaned up by converting the remaining packages that are in
+    # the first category into a typical python source layout (that is, another
+    # layer of directory nesting) and automatically adding all subdirectories of
+    # python-packages to the PYTHONPATH instead of manually curating this. We
+    # can't convert the packages like adb to the other style because doing so
+    # would prevent exporting type info from those packages.
+    #
+    # http://b/266688086
+    export ANDROID_PYTHONPATH=$T/development/python-packages/adb:$T/development/python-packages:
     if [ -n $VENDOR_PYTHONPATH ]; then
         ANDROID_PYTHONPATH=$ANDROID_PYTHONPATH$VENDOR_PYTHONPATH
     fi
@@ -1236,6 +1253,18 @@
         -exec grep --color -n "$@" {} +
 }
 
+function jsongrep()
+{
+    find . -name .repo -prune -o -name .git -prune -o -name out -prune -o -type f -name "*\.json" \
+        -exec grep --color -n "$@" {} +
+}
+
+function tomlgrep()
+{
+    find . -name .repo -prune -o -name .git -prune -o -name out -prune -o -type f -name "*\.toml" \
+        -exec grep --color -n "$@" {} +
+}
+
 function ktgrep()
 {
     find . -name .repo -prune -o -name .git -prune -o -name out -prune -o -type f -name "*\.kt" \
@@ -1852,11 +1881,6 @@
         color_reset=""
     fi
 
-    if [[ "x${USE_RBE}" == "x" && $mins -gt 15 && "${ANDROID_BUILD_ENVIRONMENT_CONFIG}" == "googler" ]]; then
-        echo
-        echo "${color_warning}Start using RBE (http://go/build-fast) to get faster builds!${color_reset}"
-    fi
-
     echo
     if [ $ret -eq 0 ] ; then
         echo -n "${color_success}#### build completed successfully "
diff --git a/finalize-locally-mainline-sdk.sh b/finalize-locally-mainline-sdk.sh
new file mode 100755
index 0000000..c72ef8c
--- /dev/null
+++ b/finalize-locally-mainline-sdk.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -ex
+
+function finalize_locally_mainline_sdk() {
+    local MAINLINE_EXTENSION='6'
+
+    local top="$(dirname "$0")"/../..
+
+    # Bump SDK extension version.
+    "$top/packages/modules/SdkExtensions/gen_sdk/bump_sdk.sh" ${MAINLINE_EXTENSION}
+
+    local version_defaults="$top/build/make/core/version_defaults.mk"
+    sed -i -e "s/PLATFORM_SDK_EXTENSION_VERSION := .*/PLATFORM_SDK_EXTENSION_VERSION := ${MAINLINE_EXTENSION}/g" $version_defaults
+
+    # Build modules SDKs.
+    TARGET_BUILD_VARIANT=userdebug UNBUNDLED_BUILD_SDKS_FROM_SOURCE=true "$top/vendor/google/build/mainline_modules_sdks.sh"
+
+    # Update prebuilts.
+    "$top/prebuilts/build-tools/path/linux-x86/python3" "$top/packages/modules/common/tools/finalize_sdk.py" -l -b 0 -f ${MAINLINE_EXTENSION} -r '' 0
+}
+
+finalize_locally_mainline_sdk
+
diff --git a/finalize-sdk-rel.sh b/finalize-sdk-rel.sh
index 35899f7..b19e56a 100755
--- a/finalize-sdk-rel.sh
+++ b/finalize-sdk-rel.sh
@@ -14,7 +14,7 @@
 
     # adb keys
     $m adb
-    LOGNAME=android-eng HOSTNAME=google.com adb keygen "$DEV_SRC_DIR/vendor/google/security/adb/${PLATFORM_VERSION}.adb_key"
+    LOGNAME=android-eng HOSTNAME=google.com "$DEV_SRC_DIR/out/host/linux-x86/bin/adb" keygen "$DEV_SRC_DIR/vendor/google/security/adb/${PLATFORM_VERSION}.adb_key"
 
     # build/make/core/version_defaults.mk
     sed -i -e "s/PLATFORM_VERSION_CODENAME.${BUILD_PREFIX} := .*/PLATFORM_VERSION_CODENAME.${BUILD_PREFIX} := REL/g" "$DEV_SRC_DIR/build/make/core/version_defaults.mk"
@@ -29,13 +29,13 @@
     cp -r "$DEV_SRC_DIR/system/sepolicy/private/" "$DEV_SRC_DIR/system/sepolicy/prebuilts/api/${PLATFORM_SDK_VERSION}.0/"
 
     # prebuilts/abi-dumps/ndk
-    git -C "$DEV_SRC_DIR/prebuilts/abi-dumps/ndk" mv current ${PLATFORM_SDK_VERSION}
+    mv "$DEV_SRC_DIR/prebuilts/abi-dumps/ndk/current" "$DEV_SRC_DIR/prebuilts/abi-dumps/ndk/$PLATFORM_SDK_VERSION"
 
     # prebuilts/abi-dumps/vndk
-    git -C "$DEV_SRC_DIR/prebuilts/abi-dumps/vndk" mv ${PLATFORM_CODENAME} ${PLATFORM_SDK_VERSION}
+    mv "$DEV_SRC_DIR/prebuilts/abi-dumps/vndk/$PLATFORM_CODENAME" "$DEV_SRC_DIR/prebuilts/abi-dumps/vndk/$PLATFORM_SDK_VERSION"
 
     # prebuilts/abi-dumps/platform
-    git -C "$DEV_SRC_DIR/prebuilts/abi-dumps/platform" mv current ${PLATFORM_SDK_VERSION}
+    mv "$DEV_SRC_DIR/prebuilts/abi-dumps/platform/current" "$DEV_SRC_DIR/prebuilts/abi-dumps/platform/$PLATFORM_SDK_VERSION"
 }
 
 finalize_sdk_rel
diff --git a/finalize-step-1-for-build-target.sh b/finalize-step-1-for-build-target.sh
index 52cf0a7..8b35a1d 100755
--- a/finalize-step-1-for-build-target.sh
+++ b/finalize-step-1-for-build-target.sh
@@ -4,49 +4,10 @@
 
 set -ex
 
-function revert_to_unfinalized_state() {
-    declare -a projects=(
-        "build/make/"
-        "build/soong/"
-        "cts/"
-        "frameworks/base/"
-        "frameworks/hardware/interfaces/"
-        "frameworks/libs/modules-utils/"
-        "frameworks/libs/net/"
-        "hardware/interfaces/"
-        "libcore/"
-        "packages/services/Car/"
-        "platform_testing/"
-        "prebuilts/abi-dumps/ndk/"
-        "prebuilts/abi-dumps/platform/"
-        "prebuilts/abi-dumps/vndk/"
-        "system/hardware/interfaces/"
-        "system/tools/aidl/"
-        "tools/platform-compat"
-        "device/generic/car"
-        "development"
-    )
-
-    for project in "${projects[@]}"
-    do
-        local git_path="$top/$project"
-        echo "Reverting: $git_path"
-        baselineHash="$(git -C $git_path log --format=%H --no-merges --max-count=1 --grep ^FINALIZATION_STEP_1_BASELINE_COMMIT)" ;
-        if [[ $baselineHash ]]; then
-          previousHash="$(git -C $git_path log --format=%H --no-merges --max-count=100 --grep ^FINALIZATION_STEP_1_SCRIPT_COMMIT $baselineHash..HEAD | tr \n \040)" ;
-        else
-          previousHash="$(git -C $git_path log --format=%H --no-merges --max-count=100 --grep ^FINALIZATION_STEP_1_SCRIPT_COMMIT | tr \n \040)" ;
-        fi ;
-        if [[ $previousHash ]]; then git -C $git_path revert --no-commit --strategy=ort --strategy-option=ours $previousHash ; fi ;
-    done
-}
-
 function finalize_step_1_main() {
     local top="$(dirname "$0")"/../..
     local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
 
-    revert_to_unfinalized_state
-
     # vndk etc finalization
     source $top/build/make/finalize-aidl-vndk-sdk-resources.sh
 
diff --git a/finalize-step-1.sh b/finalize-step-1.sh
index 20bc2bf..8871862 100755
--- a/finalize-step-1.sh
+++ b/finalize-step-1.sh
@@ -32,6 +32,9 @@
 }
 
 function finalize_step_1_main() {
+    # deprecated, do not use
+    exit 1
+
     local top="$(dirname "$0")"/../..
 
     repo selfupdate
diff --git a/finalize-step-2-for-build-target.sh b/finalize-step-2-for-build-target.sh
index caf415f..b74fd03 100755
--- a/finalize-step-2-for-build-target.sh
+++ b/finalize-step-2-for-build-target.sh
@@ -4,55 +4,19 @@
 
 set -ex
 
-function revert_to_unfinalized_state() {
-    declare -a projects=(
-        "build/make/"
-        "build/soong/"
-        "cts/"
-        "frameworks/base/"
-        "frameworks/hardware/interfaces/"
-        "frameworks/libs/modules-utils/"
-        "frameworks/libs/net/"
-        "hardware/interfaces/"
-        "libcore/"
-        "packages/services/Car/"
-        "platform_testing/"
-        "prebuilts/abi-dumps/ndk/"
-        "prebuilts/abi-dumps/platform/"
-        "prebuilts/abi-dumps/vndk/"
-        "system/hardware/interfaces/"
-        "system/tools/aidl/"
-        "tools/platform-compat"
-        "device/generic/car"
-        "development"
-    )
-
-    for project in "${projects[@]}"
-    do
-        local git_path="$top/$project"
-        echo "Reverting: $git_path"
-        baselineHash="$(git -C $git_path log --format=%H --no-merges --max-count=1 --grep ^FINALIZATION_STEP_1_BASELINE_COMMIT)" ;
-        if [[ $baselineHash ]]; then
-          previousHash="$(git -C $git_path log --format=%H --no-merges --max-count=100 --grep ^FINALIZATION_STEP_1_SCRIPT_COMMIT $baselineHash..HEAD | tr \n \040)" ;
-        else
-          previousHash="$(git -C $git_path log --format=%H --no-merges --max-count=100 --grep ^FINALIZATION_STEP_1_SCRIPT_COMMIT | tr \n \040)" ;
-        fi ;
-        if [[ $previousHash ]]; then git -C $git_path revert --no-commit --strategy=ort --strategy-option=ours $previousHash ; fi ;
-    done
-}
-
 function finalize_step_2_main() {
     local top="$(dirname "$0")"/../..
     local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
 
-    revert_to_unfinalized_state
-
     # vndk etc finalization
     source $top/build/make/finalize-aidl-vndk-sdk-resources.sh
 
     # prebuilts etc
     source $top/build/make/finalize-sdk-rel.sh
 
+    # mainline sdk prebuilts
+    source $top/build/make/finalize-locally-mainline-sdk.sh
+
     # build to confirm everything is OK
     AIDL_FROZEN_REL=true $m
 }
diff --git a/finalize-step-2.sh b/finalize-step-2.sh
index 627153b..ef80b2b 100755
--- a/finalize-step-2.sh
+++ b/finalize-step-2.sh
@@ -32,6 +32,9 @@
 }
 
 function finalize_step_2_main() {
+    # deprecated, do not use
+    exit 1
+
     local top="$(dirname "$0")"/../..
 
     repo selfupdate
diff --git a/target/board/BoardConfigEmuCommon.mk b/target/board/BoardConfigEmuCommon.mk
index 5acbe7f..7a07d70 100644
--- a/target/board/BoardConfigEmuCommon.mk
+++ b/target/board/BoardConfigEmuCommon.mk
@@ -34,7 +34,7 @@
   BOARD_BUILD_SUPER_IMAGE_BY_DEFAULT := true
 
   # 8G + 8M
-  BOARD_SUPER_PARTITION_SIZE := 8598323200
+  BOARD_SUPER_PARTITION_SIZE ?= 8598323200
   BOARD_SUPER_PARTITION_GROUPS := emulator_dynamic_partitions
 
   ifeq ($(QEMU_USE_SYSTEM_EXT_PARTITIONS),true)
@@ -57,7 +57,7 @@
   endif
 
   # 8G
-  BOARD_EMULATOR_DYNAMIC_PARTITIONS_SIZE := 8589934592
+  BOARD_EMULATOR_DYNAMIC_PARTITIONS_SIZE ?= 8589934592
 
   # in build environment to speed up make -j
   ifeq ($(QEMU_DISABLE_AVB),true)
diff --git a/target/product/AndroidProducts.mk b/target/product/AndroidProducts.mk
index 585630b..1e0ce19 100644
--- a/target/product/AndroidProducts.mk
+++ b/target/product/AndroidProducts.mk
@@ -36,6 +36,7 @@
 PRODUCT_MAKEFILES := \
     $(LOCAL_DIR)/aosp_arm64.mk \
     $(LOCAL_DIR)/aosp_arm.mk \
+    $(LOCAL_DIR)/aosp_riscv64.mk \
     $(LOCAL_DIR)/aosp_x86_64.mk \
     $(LOCAL_DIR)/aosp_x86.mk \
     $(LOCAL_DIR)/full.mk \
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index cabb172..b66d2c7 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -54,7 +54,6 @@
     com.android.appsearch \
     com.android.btservices \
     com.android.conscrypt \
-    com.android.cronet \
     com.android.extservices \
     com.android.i18n \
     com.android.ipsec \
@@ -389,6 +388,7 @@
     procrank \
     profcollectd \
     profcollectctl \
+    record_binder \
     servicedispatcher \
     showmap \
     sqlite3 \
diff --git a/target/product/gsi/33.txt b/target/product/gsi/33.txt
index 03a143d..db05f93 100644
--- a/target/product/gsi/33.txt
+++ b/target/product/gsi/33.txt
@@ -79,7 +79,6 @@
 VNDK-core: android.hardware.graphics.allocator@4.0.so
 VNDK-core: android.hardware.graphics.bufferqueue@1.0.so
 VNDK-core: android.hardware.graphics.bufferqueue@2.0.so
-VNDK-core: android.hardware.health-V1-ndk.so
 VNDK-core: android.hardware.health.storage-V1-ndk.so
 VNDK-core: android.hardware.identity-V4-ndk.so
 VNDK-core: android.hardware.ir-V1-ndk.so
diff --git a/tests/run.rbc b/tests/run.rbc
index 1b51719..33583eb 100644
--- a/tests/run.rbc
+++ b/tests/run.rbc
@@ -46,6 +46,11 @@
 assert_eq("a b c", rblf.mkstrip("  a b   \n  c \t"))
 assert_eq("1", rblf.mkstrip("1 "))
 
+assert_eq(["a", "b"], rblf.words("a b"))
+assert_eq(["a", "b", "c"], rblf.words(["a b", "c"]))
+# 1-tuple like we use in product variables
+assert_eq(["a b", ("c",)], rblf.words(["a b", ("c",)]))
+
 assert_eq("b1 b2", rblf.mksubst("a", "b", "a1 a2"))
 assert_eq(["b1", "x2"], rblf.mksubst("a", "b", ["a1", "x2"]))
 
diff --git a/tools/auto_gen_test_config.py b/tools/auto_gen_test_config.py
index 943f238..ce64160 100755
--- a/tools/auto_gen_test_config.py
+++ b/tools/auto_gen_test_config.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Copyright (C) 2017 The Android Open Source Project
 #
@@ -69,7 +69,7 @@
   module = os.path.splitext(os.path.basename(target_config))[0]
   instrumentation = instrumentation_elements[0]
   manifest = manifest_elements[0]
-  if instrumentation.attributes.has_key(ATTRIBUTE_LABEL):
+  if ATTRIBUTE_LABEL in instrumentation.attributes:
     label = instrumentation.attributes[ATTRIBUTE_LABEL].value
   else:
     label = module
diff --git a/tools/compliance/cmd/sbom/sbom.go b/tools/compliance/cmd/sbom/sbom.go
index e031052..0f8a876 100644
--- a/tools/compliance/cmd/sbom/sbom.go
+++ b/tools/compliance/cmd/sbom/sbom.go
@@ -343,9 +343,9 @@
 			if isMainPackage {
 				mainPackage = getDocumentName(ctx, tn, pm)
 				fmt.Fprintf(ctx.stdout, "SPDXVersion: SPDX-2.2\n")
-				fmt.Fprintf(ctx.stdout, "DataLicense: CC-1.0\n")
+				fmt.Fprintf(ctx.stdout, "DataLicense: CC0-1.0\n")
 				fmt.Fprintf(ctx.stdout, "DocumentName: %s\n", mainPackage)
-				fmt.Fprintf(ctx.stdout, "SPDXID: SPDXRef-DOCUMENT-%s\n", mainPackage)
+				fmt.Fprintf(ctx.stdout, "SPDXID: SPDXRef-DOCUMENT\n")
 				fmt.Fprintf(ctx.stdout, "DocumentNamespace: Android\n")
 				fmt.Fprintf(ctx.stdout, "Creator: Organization: Google LLC\n")
 				fmt.Fprintf(ctx.stdout, "Created: %s\n", ctx.creationTime().Format("2006-01-02T15:04:05Z"))
@@ -363,8 +363,8 @@
 			}()
 			if len(path) == 0 {
 				relationships = append(relationships,
-					fmt.Sprintf("Relationship: SPDXRef-DOCUMENT-%s DESCRIBES SPDXRef-Package-%s",
-						mainPackage, getPackageName(ctx, tn)))
+					fmt.Sprintf("Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-%s",
+						getPackageName(ctx, tn)))
 			} else {
 				// Check parent and identify annotation
 				parent := path[len(path)-1]
diff --git a/tools/compliance/cmd/sbom/sbom_test.go b/tools/compliance/cmd/sbom/sbom_test.go
index 4d623ce..6df74e2 100644
--- a/tools/compliance/cmd/sbom/sbom_test.go
+++ b/tools/compliance/cmd/sbom/sbom_test.go
@@ -30,9 +30,9 @@
 
 var (
 	spdxVersionTag              = regexp.MustCompile(`^\s*SPDXVersion: SPDX-2.2\s*$`)
-	spdxDataLicenseTag          = regexp.MustCompile(`^\s*DataLicense: CC-1.0\s*$`)
+	spdxDataLicenseTag          = regexp.MustCompile(`^\s*DataLicense: CC0-1.0\s*$`)
 	spdxDocumentNameTag         = regexp.MustCompile(`^\s*DocumentName:\s*Android*\s*$`)
-	spdxIDTag                   = regexp.MustCompile(`^\s*SPDXID:\s*SPDXRef-DOCUMENT-(.*)\s*$`)
+	spdxIDTag                   = regexp.MustCompile(`^\s*SPDXID:\s*SPDXRef-DOCUMENT\s*$`)
 	spdxDocumentNameSpaceTag    = regexp.MustCompile(`^\s*DocumentNamespace:\s*Android\s*$`)
 	spdxCreatorOrganizationTag  = regexp.MustCompile(`^\s*Creator:\s*Organization:\s*Google LLC\s*$`)
 	spdxCreatedTimeTag          = regexp.MustCompile(`^\s*Created: 1970-01-01T00:00:00Z\s*$`)
@@ -76,7 +76,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -85,7 +85,7 @@
 				spdxPkgID{"testdata/firstparty/highest.apex.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata-firstparty-highest.apex.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata-firstparty-highest.apex.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/firstparty/bin/bin1.meta_lic"},
 				packageName{"testdata/firstparty/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/firstparty/bin/bin1.meta_lic"},
@@ -148,7 +148,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -157,7 +157,7 @@
 				spdxPkgID{"testdata/firstparty/application.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/firstparty/application.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/firstparty/application.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/firstparty/bin/bin3.meta_lic"},
 				packageName{"testdata/firstparty/bin/bin3.meta_lic"},
 				spdxPkgID{"testdata/firstparty/bin/bin3.meta_lic"},
@@ -197,7 +197,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -206,7 +206,7 @@
 				spdxPkgID{"testdata/firstparty/container.zip.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/firstparty/container.zip.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/firstparty/container.zip.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/firstparty/bin/bin1.meta_lic"},
 				packageName{"testdata/firstparty/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/firstparty/bin/bin1.meta_lic"},
@@ -269,7 +269,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -278,7 +278,7 @@
 				spdxPkgID{"testdata/firstparty/bin/bin1.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/firstparty/bin/bin1.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/firstparty/bin/bin1.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/firstparty/lib/liba.so.meta_lic"},
 				packageName{"testdata/firstparty/lib/liba.so.meta_lic"},
 				spdxPkgID{"testdata/firstparty/lib/liba.so.meta_lic"},
@@ -311,7 +311,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -320,7 +320,7 @@
 				spdxPkgID{"testdata/firstparty/lib/libd.so.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/firstparty/lib/libd.so.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/firstparty/lib/libd.so.meta_lic", "DESCRIBES"},
 				spdxLicense{},
 				spdxLicenseID{"testdata-firstparty-FIRST_PARTY_LICENSE"},
 				spdxExtractedText{"&&&First Party License&&&"},
@@ -339,7 +339,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -348,7 +348,7 @@
 				spdxPkgID{"testdata/notice/highest.apex.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/notice/highest.apex.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/notice/highest.apex.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/notice/bin/bin1.meta_lic"},
 				packageName{"testdata/notice/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/notice/bin/bin1.meta_lic"},
@@ -415,7 +415,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -424,7 +424,7 @@
 				spdxPkgID{"testdata/notice/container.zip.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/notice/container.zip.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/notice/container.zip.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/notice/bin/bin1.meta_lic"},
 				packageName{"testdata/notice/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/notice/bin/bin1.meta_lic"},
@@ -491,7 +491,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -500,7 +500,7 @@
 				spdxPkgID{"testdata/notice/application.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata-notice-application.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata-notice-application.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/notice/bin/bin3.meta_lic"},
 				packageName{"testdata/notice/bin/bin3.meta_lic"},
 				spdxPkgID{"testdata/notice/bin/bin3.meta_lic"},
@@ -544,7 +544,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -553,7 +553,7 @@
 				spdxPkgID{"testdata/notice/bin/bin1.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/notice/bin/bin1.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/notice/bin/bin1.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/notice/lib/liba.so.meta_lic"},
 				packageName{"testdata/notice/lib/liba.so.meta_lic"},
 				spdxPkgID{"testdata/notice/lib/liba.so.meta_lic"},
@@ -590,7 +590,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -599,7 +599,7 @@
 				spdxPkgID{"testdata/notice/lib/libd.so.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-notice-NOTICE_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/notice/lib/libd.so.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/notice/lib/libd.so.meta_lic", "DESCRIBES"},
 				spdxLicense{},
 				spdxLicenseID{"testdata-notice-NOTICE_LICENSE"},
 				spdxExtractedText{"%%%Notice License%%%"},
@@ -618,7 +618,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -627,7 +627,7 @@
 				spdxPkgID{"testdata/reciprocal/highest.apex.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/reciprocal/highest.apex.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/reciprocal/highest.apex.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/reciprocal/bin/bin1.meta_lic"},
 				packageName{"testdata/reciprocal/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/reciprocal/bin/bin1.meta_lic"},
@@ -698,7 +698,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -707,7 +707,7 @@
 				spdxPkgID{"testdata/reciprocal/container.zip.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/reciprocal/container.zip.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/reciprocal/container.zip.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/reciprocal/bin/bin1.meta_lic"},
 				packageName{"testdata/reciprocal/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/reciprocal/bin/bin1.meta_lic"},
@@ -778,7 +778,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -787,7 +787,7 @@
 				spdxPkgID{"testdata/reciprocal/application.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/reciprocal/application.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/reciprocal/application.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/reciprocal/bin/bin3.meta_lic"},
 				packageName{"testdata/reciprocal/bin/bin3.meta_lic"},
 				spdxPkgID{"testdata/reciprocal/bin/bin3.meta_lic"},
@@ -835,7 +835,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -844,7 +844,7 @@
 				spdxPkgID{"testdata/reciprocal/bin/bin1.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/reciprocal/bin/bin1.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/reciprocal/bin/bin1.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/reciprocal/lib/liba.so.meta_lic"},
 				packageName{"testdata/reciprocal/lib/liba.so.meta_lic"},
 				spdxPkgID{"testdata/reciprocal/lib/liba.so.meta_lic"},
@@ -881,7 +881,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -890,7 +890,7 @@
 				spdxPkgID{"testdata/reciprocal/lib/libd.so.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-notice-NOTICE_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/reciprocal/lib/libd.so.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/reciprocal/lib/libd.so.meta_lic", "DESCRIBES"},
 				spdxLicense{},
 				spdxLicenseID{"testdata-notice-NOTICE_LICENSE"},
 				spdxExtractedText{"%%%Notice License%%%"},
@@ -910,7 +910,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -919,7 +919,7 @@
 				spdxPkgID{"testdata/restricted/highest.apex.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/restricted/highest.apex.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/restricted/highest.apex.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/restricted/bin/bin1.meta_lic"},
 				packageName{"testdata/restricted/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/restricted/bin/bin1.meta_lic"},
@@ -995,7 +995,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1004,7 +1004,7 @@
 				spdxPkgID{"testdata/restricted/container.zip.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/restricted/container.zip.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/restricted/container.zip.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/restricted/bin/bin1.meta_lic"},
 				packageName{"testdata/restricted/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/restricted/bin/bin1.meta_lic"},
@@ -1079,7 +1079,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1088,7 +1088,7 @@
 				spdxPkgID{"testdata/restricted/bin/bin1.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/restricted/bin/bin1.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/restricted/bin/bin1.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/restricted/lib/liba.so.meta_lic"},
 				packageName{"testdata/restricted/lib/liba.so.meta_lic"},
 				spdxPkgID{"testdata/restricted/lib/liba.so.meta_lic"},
@@ -1129,7 +1129,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1138,7 +1138,7 @@
 				spdxPkgID{"testdata/restricted/lib/libd.so.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-notice-NOTICE_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/restricted/lib/libd.so.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/restricted/lib/libd.so.meta_lic", "DESCRIBES"},
 				spdxLicense{},
 				spdxLicenseID{"testdata-notice-NOTICE_LICENSE"},
 				spdxExtractedText{"%%%Notice License%%%"},
@@ -1157,7 +1157,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1166,7 +1166,7 @@
 				spdxPkgID{"testdata/proprietary/highest.apex.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/proprietary/highest.apex.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/proprietary/highest.apex.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/proprietary/bin/bin1.meta_lic"},
 				packageName{"testdata/proprietary/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/proprietary/bin/bin1.meta_lic"},
@@ -1241,7 +1241,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1250,7 +1250,7 @@
 				spdxPkgID{"testdata/proprietary/container.zip.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/proprietary/container.zip.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/proprietary/container.zip.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/proprietary/bin/bin1.meta_lic"},
 				packageName{"testdata/proprietary/bin/bin1.meta_lic"},
 				spdxPkgID{"testdata/proprietary/bin/bin1.meta_lic"},
@@ -1325,7 +1325,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1334,7 +1334,7 @@
 				spdxPkgID{"testdata/proprietary/application.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/proprietary/application.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/proprietary/application.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/proprietary/bin/bin3.meta_lic"},
 				packageName{"testdata/proprietary/bin/bin3.meta_lic"},
 				spdxPkgID{"testdata/proprietary/bin/bin3.meta_lic"},
@@ -1382,7 +1382,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1391,7 +1391,7 @@
 				spdxPkgID{"testdata/proprietary/bin/bin1.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-firstparty-FIRST_PARTY_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/proprietary/bin/bin1.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/proprietary/bin/bin1.meta_lic", "DESCRIBES"},
 				packageTag{"testdata/proprietary/lib/liba.so.meta_lic"},
 				packageName{"testdata/proprietary/lib/liba.so.meta_lic"},
 				spdxPkgID{"testdata/proprietary/lib/liba.so.meta_lic"},
@@ -1428,7 +1428,7 @@
 				spdxVersion{},
 				spdxDataLicense{},
 				spdxDocumentName{"Android"},
-				spdxID{"Android"},
+				spdxID{},
 				spdxDocumentNameSpace{},
 				spdxCreatorOrganization{},
 				spdxCreatedTime{},
@@ -1437,7 +1437,7 @@
 				spdxPkgID{"testdata/proprietary/lib/libd.so.meta_lic"},
 				spdxPkgDownloadLocation{"NOASSERTION"},
 				spdxPkgLicenseDeclared{"testdata-notice-NOTICE_LICENSE"},
-				spdxRelationship{"DOCUMENT-Android ", "testdata/proprietary/lib/libd.so.meta_lic", "DESCRIBES"},
+				spdxRelationship{"DOCUMENT ", "testdata/proprietary/lib/libd.so.meta_lic", "DESCRIBES"},
 				spdxLicense{},
 				spdxLicenseID{"testdata-notice-NOTICE_LICENSE"},
 				spdxExtractedText{"%%%Notice License%%%"},
@@ -1541,20 +1541,14 @@
 	return "PackageName: " + replaceSlashes(m.name)
 }
 
-type spdxID struct {
-	name string
-}
+type spdxID struct {}
 
 func (m spdxID) isMatch(line string) bool {
-	groups := spdxIDTag.FindStringSubmatch(line)
-	if len(groups) != 2 {
-		return false
-	}
-	return groups[1] == replaceSlashes(m.name)
+	return spdxIDTag.MatchString(line)
 }
 
 func (m spdxID) String() string {
-	return "SPDXID: SPDXRef-DOCUMENT-" + replaceSlashes(m.name)
+	return "SPDXID: SPDXRef-DOCUMENT"
 }
 
 type spdxPkgID struct {
@@ -1590,7 +1584,7 @@
 }
 
 func (m spdxDataLicense) String() string {
-	return "DataLicense: CC-1.0"
+	return "DataLicense: CC0-1.0"
 }
 
 type spdxDocumentName struct {
diff --git a/tools/finalization/OWNERS b/tools/finalization/OWNERS
new file mode 100644
index 0000000..518b60d
--- /dev/null
+++ b/tools/finalization/OWNERS
@@ -0,0 +1,5 @@
+include platform/build/soong:/OWNERS
+smoreland@google.com
+alexbuy@google.com
+patb@google.com
+zyy@google.com
diff --git a/tools/finalization/cleanup.sh b/tools/finalization/cleanup.sh
new file mode 100755
index 0000000..cd87b1d
--- /dev/null
+++ b/tools/finalization/cleanup.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+# Brings local repository to a remote head state.
+
+# set -ex
+
+function finalize_revert_local_changes_main() {
+    local top="$(dirname "$0")"/../../../..
+    local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
+
+    # remove the out folder
+    $m clobber
+
+    repo selfupdate
+
+    repo forall -c '\
+        git checkout . ; git revert --abort ; git clean -fdx ;\
+        git checkout @ ; git branch fina-step1 -D ; git reset --hard; \
+        repo start fina-step1 ; git checkout @ ; git b fina-step1 -D ;'
+}
+
+finalize_revert_local_changes_main
diff --git a/tools/finalization/environment.sh b/tools/finalization/environment.sh
new file mode 100755
index 0000000..125c704
--- /dev/null
+++ b/tools/finalization/environment.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -ex
+
+export FINAL_BUG_ID='0'
+
+export FINAL_PLATFORM_CODENAME='UpsideDownCake'
+export FINAL_PLATFORM_CODENAME_JAVA='UPSIDE_DOWN_CAKE'
+export FINAL_PLATFORM_SDK_VERSION='34'
+export FINAL_PLATFORM_VERSION='14'
+
+export FINAL_BUILD_PREFIX='UP1A'
+
+export FINAL_MAINLINE_EXTENSION='6'
+export FINAL_MAINLINE_SDK_COMMIT_MESSAGE=''
+export FINAL_MAINLINE_SDK_BUILD_ID=0
diff --git a/tools/finalization/finalize-aidl-vndk-sdk-resources.sh b/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
new file mode 100755
index 0000000..0426fdd
--- /dev/null
+++ b/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -ex
+
+function finalize_aidl_vndk_sdk_resources() {
+    local top="$(dirname "$0")"/../../../..
+    source $top/build/make/tools/finalization/environment.sh
+
+    local SDK_CODENAME="public static final int $FINAL_PLATFORM_CODENAME_JAVA = CUR_DEVELOPMENT;"
+    local SDK_VERSION="public static final int $FINAL_PLATFORM_CODENAME_JAVA = $FINAL_PLATFORM_SDK_VERSION;"
+
+    # default target to modify tree and build SDK
+    local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
+
+    # This script is WIP and only finalizes part of the Android branch for release.
+    # The full process can be found at (INTERNAL) go/android-sdk-finalization.
+
+    # Update references in the codebase to new API version (TODO)
+
+    # bionic/NDK
+    # Adding __ANDROID_API_<>__.
+    # If this hasn't done then it's not used and not really needed. Still, let's check and add this.
+    if ! grep -q "\__.*$((${FINAL_PLATFORM_SDK_VERSION}))" api-level.h ; then
+        local tmpfile=$(mktemp /tmp/finalization.XXXXXX)
+        echo "
+/** Names the \"${FINAL_PLATFORM_CODENAME:0:1}\" API level ($FINAL_PLATFORM_SDK_VERSION), for comparison against \`__ANDROID_API__\`. */
+#define __ANDROID_API_${FINAL_PLATFORM_CODENAME:0:1}__ $FINAL_PLATFORM_SDK_VERSION" > "$tmpfile"
+
+        local api_level="$top/bionic/libc/include/android/api-level.h"
+        sed -i -e "/__.*$((${FINAL_PLATFORM_SDK_VERSION}-1))/r""$tmpfile" $api_level
+
+        rm "$tmpfile"
+    fi
+
+    # VNDK definitions for new SDK version
+    cp "$top/development/vndk/tools/definition-tool/datasets/vndk-lib-extra-list-current.txt" \
+       "$top/development/vndk/tools/definition-tool/datasets/vndk-lib-extra-list-$FINAL_PLATFORM_SDK_VERSION.txt"
+
+    AIDL_TRANSITIVE_FREEZE=true $m aidl-freeze-api create_reference_dumps
+
+    # Generate ABI dumps
+    ANDROID_BUILD_TOP="$top" \
+        out/host/linux-x86/bin/create_reference_dumps \
+        -p aosp_arm64 --build-variant user
+
+    echo "NOTE: THIS INTENTIONALLY MAY FAIL AND REPAIR ITSELF (until 'DONE')"
+    # Update new versions of files. See update-vndk-list.sh (which requires envsetup.sh)
+    $m check-vndk-list || \
+        { cp $top/out/soong/vndk/vndk.libraries.txt $top/build/make/target/product/gsi/current.txt; }
+    echo "DONE: THIS INTENTIONALLY MAY FAIL AND REPAIR ITSELF"
+
+    # Finalize SDK
+
+    # build/make
+    local version_defaults="$top/build/make/core/version_defaults.mk"
+    sed -i -e "s/PLATFORM_SDK_VERSION := .*/PLATFORM_SDK_VERSION := ${FINAL_PLATFORM_SDK_VERSION}/g" $version_defaults
+    sed -i -e "s/PLATFORM_VERSION_LAST_STABLE := .*/PLATFORM_VERSION_LAST_STABLE := ${FINAL_PLATFORM_VERSION}/g" $version_defaults
+    sed -i -e "s/sepolicy_major_vers := .*/sepolicy_major_vers := ${FINAL_PLATFORM_SDK_VERSION}/g" "$top/build/make/core/config.mk"
+    cp "$top/build/make/target/product/gsi/current.txt" "$top/build/make/target/product/gsi/$FINAL_PLATFORM_SDK_VERSION.txt"
+
+    # build/soong
+    sed -i -e "/:.*$((${FINAL_PLATFORM_SDK_VERSION}-1)),/a \\\t\t\t\"${FINAL_PLATFORM_CODENAME}\":     ${FINAL_PLATFORM_SDK_VERSION}," "$top/build/soong/android/api_levels.go"
+
+    # cts
+    echo ${FINAL_PLATFORM_VERSION} > "$top/cts/tests/tests/os/assets/platform_releases.txt"
+    sed -i -e "s/EXPECTED_SDK = $((${FINAL_PLATFORM_SDK_VERSION}-1))/EXPECTED_SDK = ${FINAL_PLATFORM_SDK_VERSION}/g" "$top/cts/tests/tests/os/src/android/os/cts/BuildVersionTest.java"
+
+    # libcore
+    sed -i "s%$SDK_CODENAME%$SDK_VERSION%g" "$top/libcore/dalvik/src/main/java/dalvik/annotation/compat/VersionCodes.java"
+
+    # platform_testing
+    local version_codes="$top/platform_testing/libraries/compatibility-common-util/src/com/android/compatibility/common/util/VersionCodes.java"
+    sed -i -e "/=.*$((${FINAL_PLATFORM_SDK_VERSION}-1));/a \\    ${SDK_VERSION}" $version_codes
+
+    # Finalize resources
+    "$top/frameworks/base/tools/aapt2/tools/finalize_res.py" \
+           "$top/frameworks/base/core/res/res/values/public-staging.xml" \
+           "$top/frameworks/base/core/res/res/values/public-final.xml"
+
+    # frameworks/base
+    sed -i "s%$SDK_CODENAME%$SDK_VERSION%g" "$top/frameworks/base/core/java/android/os/Build.java"
+    sed -i -e "/=.*$((${FINAL_PLATFORM_SDK_VERSION}-1)),/a \\    SDK_${FINAL_PLATFORM_CODENAME_JAVA} = ${FINAL_PLATFORM_SDK_VERSION}," "$top/frameworks/base/tools/aapt/SdkConstants.h"
+    sed -i -e "/=.*$((${FINAL_PLATFORM_SDK_VERSION}-1)),/a \\  SDK_${FINAL_PLATFORM_CODENAME_JAVA} = ${FINAL_PLATFORM_SDK_VERSION}," "$top/frameworks/base/tools/aapt2/SdkConstants.h"
+
+    # Bump Mainline SDK extension version.
+    "$top/packages/modules/SdkExtensions/gen_sdk/bump_sdk.sh" ${FINAL_MAINLINE_EXTENSION}
+    local version_defaults="$top/build/make/core/version_defaults.mk"
+    sed -i -e "s/PLATFORM_SDK_EXTENSION_VERSION := .*/PLATFORM_SDK_EXTENSION_VERSION := ${FINAL_MAINLINE_EXTENSION}/g" $version_defaults
+
+    # Force update current.txt
+    $m clobber
+    $m update-api
+}
+
+finalize_aidl_vndk_sdk_resources
+
diff --git a/tools/finalization/finalize-sdk-rel.sh b/tools/finalization/finalize-sdk-rel.sh
new file mode 100755
index 0000000..6e62a0e
--- /dev/null
+++ b/tools/finalization/finalize-sdk-rel.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+set -ex
+
+function finalize_sdk_rel() {
+    local top="$(dirname "$0")"/../../../..
+    source $top/build/make/tools/finalization/environment.sh
+
+    # default target to modify tree and build SDK
+    local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
+
+    # adb keys
+    $m adb
+    LOGNAME=android-eng HOSTNAME=google.com "$top/out/host/linux-x86/bin/adb" keygen "$top/vendor/google/security/adb/${FINAL_PLATFORM_VERSION}.adb_key"
+
+    # build/make/core/version_defaults.mk
+    sed -i -e "s/PLATFORM_VERSION_CODENAME.${FINAL_BUILD_PREFIX} := .*/PLATFORM_VERSION_CODENAME.${FINAL_BUILD_PREFIX} := REL/g" "$top/build/make/core/version_defaults.mk"
+
+    # cts
+    echo "$FINAL_PLATFORM_VERSION" > "$top/cts/tests/tests/os/assets/platform_versions.txt"
+    git -C "$top/cts" mv hostsidetests/theme/assets/${FINAL_PLATFORM_CODENAME} hostsidetests/theme/assets/${FINAL_PLATFORM_SDK_VERSION}
+
+    # system/sepolicy
+    mkdir -p "$top/system/sepolicy/prebuilts/api/${FINAL_PLATFORM_SDK_VERSION}.0/"
+    cp -r "$top/system/sepolicy/public/" "$top/system/sepolicy/prebuilts/api/${FINAL_PLATFORM_SDK_VERSION}.0/"
+    cp -r "$top/system/sepolicy/private/" "$top/system/sepolicy/prebuilts/api/${FINAL_PLATFORM_SDK_VERSION}.0/"
+
+    # prebuilts/abi-dumps/ndk
+    mv "$top/prebuilts/abi-dumps/ndk/current" "$top/prebuilts/abi-dumps/ndk/$FINAL_PLATFORM_SDK_VERSION"
+
+    # prebuilts/abi-dumps/vndk
+    mv "$top/prebuilts/abi-dumps/vndk/$FINAL_PLATFORM_CODENAME" "$top/prebuilts/abi-dumps/vndk/$FINAL_PLATFORM_SDK_VERSION"
+
+    # prebuilts/abi-dumps/platform
+    mv "$top/prebuilts/abi-dumps/platform/current" "$top/prebuilts/abi-dumps/platform/$FINAL_PLATFORM_SDK_VERSION"
+}
+
+finalize_sdk_rel
+
diff --git a/tools/finalization/localonly-finalize-mainline-sdk.sh b/tools/finalization/localonly-finalize-mainline-sdk.sh
new file mode 100755
index 0000000..fc887c3
--- /dev/null
+++ b/tools/finalization/localonly-finalize-mainline-sdk.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -ex
+
+function finalize_locally_mainline_sdk() {
+    local top="$(dirname "$0")"/../../../..
+    source $top/build/make/tools/finalization/environment.sh
+
+    # Build modules SDKs.
+    TARGET_BUILD_VARIANT=userdebug UNBUNDLED_BUILD_SDKS_FROM_SOURCE=true "$top/vendor/google/build/mainline_modules_sdks.sh"
+
+    # Update prebuilts.
+    "$top/prebuilts/build-tools/path/linux-x86/python3" "$top/packages/modules/common/tools/finalize_sdk.py" -l -b 0 -f ${FINAL_MAINLINE_EXTENSION} -r '' 0
+}
+
+finalize_locally_mainline_sdk
+
diff --git a/tools/finalization/step-1.sh b/tools/finalization/step-1.sh
new file mode 100755
index 0000000..db7f1cc
--- /dev/null
+++ b/tools/finalization/step-1.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+# Script to perform a 1st step of Android Finalization: API/SDK finalization, create CLs and upload to Gerrit.
+
+set -ex
+
+function commit_step_1_changes() {
+    set +e
+    repo forall -c '\
+        if [[ $(git status --short) ]]; then
+            repo start "$FINAL_PLATFORM_CODENAME-SDK-Finalization" ;
+            git add -A . ;
+            git commit -m "$FINAL_PLATFORM_CODENAME is now $FINAL_PLATFORM_SDK_VERSION" \
+                       -m "Ignore-AOSP-First: $FINAL_PLATFORM_CODENAME Finalization
+Bug: $FINAL_BUG_ID
+Test: build";
+            repo upload --cbr --no-verify -o nokeycheck -t -y . ;
+            git clean -fdx ; git reset --hard ;
+        fi'
+}
+
+function finalize_step_1_main() {
+    local top="$(dirname "$0")"/../../../..
+    source $top/build/make/tools/finalization/environment.sh
+
+    local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
+
+    # vndk etc finalization
+    source $top/build/make/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
+
+    # build to confirm everything is OK
+    AIDL_FROZEN_REL=true $m
+
+    # move all changes to finalization branch/topic and upload to gerrit
+    commit_step_1_changes
+}
+
+finalize_step_1_main
diff --git a/tools/finalization/step-2.sh b/tools/finalization/step-2.sh
new file mode 100755
index 0000000..926b850
--- /dev/null
+++ b/tools/finalization/step-2.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# Script to perform a 2nd step of Android Finalization: REL finalization, create CLs and upload to Gerrit.
+
+function commit_step_2_changes() {
+    repo forall -c '\
+        if [[ $(git status --short) ]]; then
+            repo start "$FINAL_PLATFORM_CODENAME-SDK-Finalization-Rel" ;
+            git add -A . ;
+            git commit -m "$FINAL_PLATFORM_CODENAME/$FINAL_PLATFORM_SDK_VERSION is now REL" \
+                       -m "Ignore-AOSP-First: $FINAL_PLATFORM_CODENAME Finalization
+Bug: $FINAL_BUG_ID
+Test: build";
+
+            repo upload --cbr --no-verify -o nokeycheck -t -y . ;
+            git clean -fdx ; git reset --hard ;
+        fi'
+}
+
+function finalize_step_2_main() {
+    local top="$(dirname "$0")"/../../../..
+    source $top/build/make/tools/finalization/environment.sh
+
+    local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
+
+    # prebuilts etc
+    source $top/build/make/tools/finalization/finalize-sdk-rel.sh
+
+    # Update prebuilts.
+    "$top/prebuilts/build-tools/path/linux-x86/python3" "$top/packages/modules/common/tools/finalize_sdk.py" -b ${FINAL_BUG_ID} -f ${FINAL_MAINLINE_EXTENSION} -r "${FINAL_MAINLINE_SDK_COMMIT_MESSAGE}" ${FINAL_MAINLINE_SDK_BUILD_ID}
+
+    # build to confirm everything is OK
+    AIDL_FROZEN_REL=true $m
+
+    # move all changes to finalization branch/topic and upload to gerrit
+    commit_step_2_changes
+}
+
+finalize_step_2_main
diff --git a/tools/releasetools/apex_utils.py b/tools/releasetools/apex_utils.py
index 194ff58..40f7c92 100644
--- a/tools/releasetools/apex_utils.py
+++ b/tools/releasetools/apex_utils.py
@@ -66,7 +66,7 @@
     self.fsckerofs_path = os.path.join(
         OPTIONS.search_path, "bin", "fsck.erofs")
     self.blkid_path = os.path.join(
-        OPTIONS.search_path, "bin", "blkid")
+        OPTIONS.search_path, "bin", "blkid_static")
     self.avbtool = avbtool if avbtool else "avbtool"
     self.sign_tool = sign_tool
 
diff --git a/tools/releasetools/check_target_files_vintf.py b/tools/releasetools/check_target_files_vintf.py
index a254cab..5b71c72 100755
--- a/tools/releasetools/check_target_files_vintf.py
+++ b/tools/releasetools/check_target_files_vintf.py
@@ -237,7 +237,7 @@
   if OPTIONS.search_path:
     debugfs_path = os.path.join(OPTIONS.search_path, 'bin', 'debugfs_static')
     deapexer_path = os.path.join(OPTIONS.search_path, 'bin', 'deapexer')
-    blkid_path = os.path.join(OPTIONS.search_path, 'bin', 'blkid')
+    blkid_path = os.path.join(OPTIONS.search_path, 'bin', 'blkid_static')
     fsckerofs_path = os.path.join(OPTIONS.search_path, 'bin', 'fsck.erofs')
     if os.path.isfile(deapexer_path):
       deapexer = deapexer_path
diff --git a/tools/releasetools/non_ab_ota.py b/tools/releasetools/non_ab_ota.py
index ac85aa4..7078d67 100644
--- a/tools/releasetools/non_ab_ota.py
+++ b/tools/releasetools/non_ab_ota.py
@@ -48,17 +48,12 @@
     # if the filesystem is ext4.
     partition_source_info = source_info["fstab"]["/" + name]
     check_first_block = partition_source_info.fs_type == "ext4"
-    # Disable using imgdiff for squashfs. 'imgdiff -z' expects input files to be
-    # in zip formats. However with squashfs, a) all files are compressed in LZ4;
-    # b) the blocks listed in block map may not contain all the bytes for a
-    # given file (because they're rounded to be 4K-aligned).
-    partition_target_info = target_info["fstab"]["/" + name]
-    disable_imgdiff = (partition_source_info.fs_type == "squashfs" or
-                       partition_target_info.fs_type == "squashfs")
+    # Disable imgdiff because it relies on zlib to produce stable output
+    # across different versions, which is often not the case.
     return common.BlockDifference(name, partition_tgt, partition_src,
                                   check_first_block,
                                   version=blockimgdiff_version,
-                                  disable_imgdiff=disable_imgdiff)
+                                  disable_imgdiff=True)
 
   if source_zip:
     # See notes in common.GetUserImage()
@@ -282,7 +277,7 @@
   needed_property_files = (
       NonAbOtaPropertyFiles(),
   )
-  FinalizeMetadata(metadata, staging_file, output_file, needed_property_files)
+  FinalizeMetadata(metadata, staging_file, output_file, needed_property_files, package_key=OPTIONS.package_key)
 
 
 def WriteBlockIncrementalOTAPackage(target_zip, source_zip, output_file):
@@ -409,7 +404,7 @@
   if updating_boot:
     boot_type, boot_device_expr = common.GetTypeAndDeviceExpr("/boot",
                                                               source_info)
-    d = common.Difference(target_boot, source_boot)
+    d = common.Difference(target_boot, source_boot, "bsdiff")
     _, _, d = d.ComputePatch()
     if d is None:
       include_full_boot = True
@@ -537,7 +532,7 @@
   needed_property_files = (
       NonAbOtaPropertyFiles(),
   )
-  FinalizeMetadata(metadata, staging_file, output_file, needed_property_files)
+  FinalizeMetadata(metadata, staging_file, output_file, needed_property_files, package_key=OPTIONS.package_key)
 
 
 def GenerateNonAbOtaPackage(target_file, output_file, source_file=None):
diff --git a/tools/releasetools/ota_utils.py b/tools/releasetools/ota_utils.py
index e36a2be..e2ce31d 100644
--- a/tools/releasetools/ota_utils.py
+++ b/tools/releasetools/ota_utils.py
@@ -132,8 +132,10 @@
 
   # Re-sign the package after updating the metadata entry.
   if no_signing:
+    logger.info(f"Signing disabled for output file {output_file}")
     shutil.copy(prelim_signing, output_file)
   else:
+    logger.info(f"Signing the output file {output_file} with key {package_key}")
     SignOutput(prelim_signing, output_file, package_key, pw)
 
   # Reopen the final signed zip to double check the streaming metadata.
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 0dd0790..4a12e74 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -532,11 +532,13 @@
       # as a symlink in the current code. So it's a no-op here. Keeping the
       # path here for clarity.
       # Some build props might be stored under path
-      # VENDOR_BOOT/RAMDISK_FRAGMENTS/recovery/RAMDISK/default.prop
-      # so overwrite all files that ends with build.prop or default.prop
+      # VENDOR_BOOT/RAMDISK_FRAGMENTS/recovery/RAMDISK/default.prop, and
+      # default.prop can be a symbolic link to prop.default, so overwrite all
+      # files that ends with build.prop, default.prop or prop.default
       "RECOVERY/RAMDISK/default.prop") or \
         filename.endswith("build.prop") or \
-        filename.endswith("/default.prop")
+        filename.endswith("/default.prop") or \
+        filename.endswith("/prop.default")
 
 
 def ProcessTargetFiles(input_tf_zip, output_tf_zip, misc_info,
diff --git a/tools/signapk/Android.bp b/tools/signapk/Android.bp
index bee6a6f..c4f25f8 100644
--- a/tools/signapk/Android.bp
+++ b/tools/signapk/Android.bp
@@ -31,6 +31,10 @@
         "conscrypt-unbundled",
     ],
 
+    // b/267608166: Prevent target Java 17 so the host-side tool can run in an
+    // environment where JDK 11 is available.
+    java_version: "11",
+
     jni_libs: ["libconscrypt_openjdk_jni"],
 
     // The post-build signing tools need signapk.jar (and its shared libraries,