diff --git a/CleanSpec.mk b/CleanSpec.mk
index 23eba4f..3ba1f45 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -442,6 +442,8 @@
 $(call add-clean-step, rm -rf $(OUT_DIR)/host/common/obj/*/*_intermediates/src)
 $(call add-clean-step, rm -f $(OUT_DIR)/host/common/obj/*/*_intermediates/java-source-list)
 
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/APPS/*/flat-res)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/aapt2.mk b/core/aapt2.mk
index c7cae44..8bb2d4b 100644
--- a/core/aapt2.mk
+++ b/core/aapt2.mk
@@ -47,8 +47,10 @@
 my_generated_resources_flata += $(my_generated_resources_flata)
 endif
 
+# Always set --pseudo-localize, it will be stripped out later for release
+# builds that don't want it.
 $(my_res_resources_flat) $(my_overlay_resources_flat) $(my_generated_resources_flata): \
-  PRIVATE_AAPT2_CFLAGS := $(PRODUCT_AAPT2_CFLAGS)
+  PRIVATE_AAPT2_CFLAGS := --pseudo-localize
 
 my_static_library_resources := $(foreach l, $(call reverse-list,$(LOCAL_STATIC_ANDROID_LIBRARIES)),\
   $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/package-res.apk)
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index f5b45db..79604ac 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -235,6 +235,11 @@
   # entire module.
   LOCAL_ARM_MODE := thumb
   my_cflags += $(CFI_EXTRA_CFLAGS)
+  # Only append the default visibility flag if -fvisibility has not already been
+  # set to hidden.
+  ifeq ($(filter -fvisibility=hidden,$(LOCAL_CFLAGS)),)
+    my_cflags += -fvisibility=default
+  endif
   my_ldflags += $(CFI_EXTRA_LDFLAGS)
   my_arflags += --plugin $(LLVM_PREBUILTS_PATH)/../lib64/LLVMgold.so
   # Workaround for b/33678192. CFI jumptables need Thumb2 codegen.  Revert when
@@ -242,6 +247,15 @@
   ifneq ($(filter arm,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
     my_ldflags += -march=armv7-a
   endif
+
+  ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
+        my_ldflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_ldflags))
+        my_cflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_cflags))
+  else
+        # Apply the version script to non-static executables
+        my_ldflags += -Wl,--version-script,build/soong/cc/config/cfi_exports.map
+        LOCAL_ADDITIONAL_DEPENDENCIES += build/soong/cc/config/cfi_exports.map
+  endif
 endif
 
 # If local or global modules need ASAN, add linker flags.
@@ -293,11 +307,16 @@
 endif
 
 ifneq ($(my_sanitize_diag),)
-  notrap_arg := $(subst $(space),$(comma),$(my_sanitize_diag)),
-  my_cflags += -fno-sanitize-trap=$(notrap_arg)
-  # Diagnostic requires a runtime library, unless ASan or TSan are also enabled.
-  ifeq ($(filter address thread,$(my_sanitize)),)
-    # Does not have to be the first DT_NEEDED unlike ASan.
-    my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY)
+  # TODO(vishwath): Add diagnostic support for static executables once
+  # we switch to clang-4393122 (which adds the static ubsan runtime
+  # that this depends on)
+  ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
+    notrap_arg := $(subst $(space),$(comma),$(my_sanitize_diag)),
+    my_cflags += -fno-sanitize-trap=$(notrap_arg)
+    # Diagnostic requires a runtime library, unless ASan or TSan are also enabled.
+    ifeq ($(filter address thread,$(my_sanitize)),)
+      # Does not have to be the first DT_NEEDED unlike ASan.
+      my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY)
+    endif
   endif
 endif
diff --git a/core/definitions.mk b/core/definitions.mk
index b988d1e..a8644d6 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -1556,7 +1556,7 @@
         filelist="$$filelist $$ldir/$$ext$$f"; \
     done ; \
     $($(PRIVATE_2ND_ARCH_VAR_PREFIX)TARGET_AR) $($(PRIVATE_2ND_ARCH_VAR_PREFIX)TARGET_GLOBAL_ARFLAGS) \
-        $(2) $$filelist
+        $(PRIVATE_ARFLAGS) $(2) $$filelist
 
 endef
 
diff --git a/core/dpi_specific_apk.mk b/core/dpi_specific_apk.mk
index 18c8d6e..ac5c4a9 100644
--- a/core/dpi_specific_apk.mk
+++ b/core/dpi_specific_apk.mk
@@ -9,7 +9,7 @@
 
 # Set up all the target-specific variables.
 $(built_dpi_apk): PRIVATE_MODULE := $(dpi_apk_name)
-$(built_dpi_apk): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS) $(PRODUCT_AAPT_FLAGS) $($(LOCAL_PACKAGE_NAME)_aapt_flags_$(my_dpi))
+$(built_dpi_apk): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS) --pseudo-localize $($(LOCAL_PACKAGE_NAME)_aapt_flags_$(my_dpi))
 # Clear PRIVATE_PRODUCT_AAPT_CONFIG to include everything by default.
 $(built_dpi_apk): PRIVATE_PRODUCT_AAPT_CONFIG :=
 $(built_dpi_apk): PRIVATE_PRODUCT_AAPT_PREF_CONFIG := $(my_dpi)
diff --git a/core/package_internal.mk b/core/package_internal.mk
index 01e2463..16563af 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -353,7 +353,7 @@
 endif
 
 ifdef LOCAL_USE_AAPT2
-my_compiled_res_base_dir := $(intermediates)/flat-res
+my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res
 renderscript_target_api :=
 ifneq (,$(LOCAL_RENDERSCRIPT_TARGET_API))
 renderscript_target_api := $(LOCAL_RENDERSCRIPT_TARGET_API)
diff --git a/core/product_config.mk b/core/product_config.mk
index 04f02da..deb68ba 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -151,6 +151,13 @@
 endif # unbundled_goals
 endif
 
+# Now that we've parsed APP-* and PRODUCT-*, mark these as readonly
+TARGET_BUILD_APPS ?=
+.KATI_READONLY := \
+  TARGET_PRODUCT \
+  TARGET_BUILD_VARIANT \
+  TARGET_BUILD_APPS
+
 # Default to building dalvikvm on hosts that support it...
 ifeq ($(HOST_OS),linux)
 # ... or if the if the option is already set
@@ -295,15 +302,6 @@
 PRODUCT_AAPT_CONFIG := \
     $(subst $(space),$(comma),$(strip $(PRODUCT_AAPT_CONFIG)))
 
-# product-scoped aapt flags
-PRODUCT_AAPT_FLAGS :=
-PRODUCT_AAPT2_CFLAGS :=
-ifneq ($(filter en_XA ar_XB,$(PRODUCT_LOCALES)),)
-  # Force generating resources for pseudo-locales.
-  PRODUCT_AAPT2_CFLAGS += --pseudo-localize
-  PRODUCT_AAPT_FLAGS += --pseudo-localize
-endif
-
 PRODUCT_BRAND := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_BRAND))
 
 PRODUCT_MODEL := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_MODEL))
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index a9a5306..2fadfa6 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -107,32 +107,7 @@
 # need this for gles libraries to load properly
 # after moving to /vendor/lib/
 PRODUCT_PACKAGES += \
-    android.hardware.renderscript@1.0.vndk-sp\
-    android.hardware.graphics.allocator@2.0.vndk-sp\
-    android.hardware.graphics.mapper@2.0.vndk-sp\
-    android.hardware.graphics.common@1.0.vndk-sp\
-    libhwbinder.vndk-sp\
-    libbase.vndk-sp\
-    libcutils.vndk-sp\
-    libhardware.vndk-sp\
-    libhidlbase.vndk-sp\
-    libhidltransport.vndk-sp\
-    libutils.vndk-sp\
-    libc++.vndk-sp\
-    libRS_internal.vndk-sp\
-    libRSDriver.vndk-sp\
-    libRSCpuRef.vndk-sp\
-    libbcinfo.vndk-sp\
-    libblas.vndk-sp\
-    libft2.vndk-sp\
-    libpng.vndk-sp\
-    libcompiler_rt.vndk-sp\
-    libbacktrace.vndk-sp\
-    libunwind.vndk-sp\
-    libunwindstack.vndk-sp\
-    liblzma.vndk-sp\
-    libz.vndk-sp\
-
+    vndk-sp
 
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/init.ranchu-core.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-core.sh \
diff --git a/tools/signapk/src/com/android/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
index 3b00599..fdf6283 100644
--- a/tools/signapk/src/com/android/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -1082,14 +1082,15 @@
                     ByteBuffer[] outputChunks = new ByteBuffer[] {v1SignedApk};
 
                     ZipSections zipSections = findMainZipSections(v1SignedApk);
-                    ApkSignerEngine.OutputApkSigningBlockRequest addV2SignatureRequest =
-                            apkSigner.outputZipSections(
+                    ApkSignerEngine.OutputApkSigningBlockRequest2 addV2SignatureRequest =
+                            apkSigner.outputZipSections2(
                                     DataSources.asDataSource(zipSections.beforeCentralDir),
                                     DataSources.asDataSource(zipSections.centralDir),
                                     DataSources.asDataSource(zipSections.eocd));
                     if (addV2SignatureRequest != null) {
                         // Need to insert the returned APK Signing Block before ZIP Central
                         // Directory.
+                        int padding = addV2SignatureRequest.getPaddingSizeBeforeApkSigningBlock();
                         byte[] apkSigningBlock = addV2SignatureRequest.getApkSigningBlock();
                         // Because the APK Signing Block is inserted before the Central Directory,
                         // we need to adjust accordingly the offset of Central Directory inside the
@@ -1100,10 +1101,12 @@
                         modifiedEocd.order(ByteOrder.LITTLE_ENDIAN);
                         ApkUtils.setZipEocdCentralDirectoryOffset(
                                 modifiedEocd,
-                                zipSections.beforeCentralDir.remaining() + apkSigningBlock.length);
+                                zipSections.beforeCentralDir.remaining() + padding +
+                                apkSigningBlock.length);
                         outputChunks =
                                 new ByteBuffer[] {
                                         zipSections.beforeCentralDir,
+                                        ByteBuffer.allocate(padding),
                                         ByteBuffer.wrap(apkSigningBlock),
                                         zipSections.centralDir,
                                         modifiedEocd};