diff --git a/CleanSpec.mk b/CleanSpec.mk
index 67aca7c..41defb2 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -751,6 +751,10 @@
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/default.prop)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/prop.default)
 
+# Workaround for Soong not being able to rebuild the host binary if its
+# JNI dependencies change: b/170389375
+$(call add-clean-step, rm -rf $(OUT_DIR)/soong/host/*/lib*/libconscrypt_openjdk_jni.so)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/OWNERS b/OWNERS
index 05f8b3d..4cac0f5 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,11 +1 @@
-# Core build team (MTV)
-ccross@android.com
-dwillemsen@google.com
-asmundak@google.com
-jungjw@google.com
-
-# To expedite LON reviews
-hansson@google.com
-
-# For version updates
-per-file version_defaults.mk = aseaton@google.com,elisapascual@google.com,lubomir@google.com,pscovanner@google.com
+include platform/build/soong:/OWNERS
diff --git a/core/Makefile b/core/Makefile
index 467db19..b28a87d 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1289,7 +1289,13 @@
 # Get a colon-separated list of search paths.
 INTERNAL_USERIMAGES_BINARY_PATHS := $(subst $(space),:,$(sort $(dir $(INTERNAL_USERIMAGES_DEPS))))
 
+# Collects file_contexts files from modules to be installed
+$(call merge-fc-files, \
+  $(sort $(foreach m,$(product_MODULES),$(ALL_MODULES.$(m).FILE_CONTEXTS))),\
+  $(call intermediates-dir-for,ETC,file_contexts.bin)/file_contexts.modules.tmp)
+
 SELINUX_FC := $(call intermediates-dir-for,ETC,file_contexts.bin)/file_contexts.bin
+
 INTERNAL_USERIMAGES_DEPS += $(SELINUX_FC)
 
 ifeq (true,$(PRODUCT_USE_DYNAMIC_PARTITIONS))
@@ -2088,6 +2094,7 @@
 #
 # Note: it's intentional to skip signing for boot-debug.img, because it
 # can only be used if the device is unlocked with verification error.
+ifdef BUILDING_BOOT_IMAGE
 ifneq ($(strip $(TARGET_NO_KERNEL)),true)
 ifneq ($(strip $(BOARD_KERNEL_BINARIES)),)
   INSTALLED_DEBUG_BOOTIMAGE_TARGET := $(foreach k,$(subst kernel,boot-debug,$(BOARD_KERNEL_BINARIES)), \
@@ -2142,6 +2149,7 @@
 	$(foreach b,$(INSTALLED_DEBUG_BOOTIMAGE_TARGET),$(call build-debug-bootimage-target,$b))
 
 endif # TARGET_NO_KERNEL
+endif # BUILDING_BOOT_IMAGE
 
 ifeq ($(BUILDING_VENDOR_BOOT_IMAGE),true)
 ifeq ($(BUILDING_RAMDISK_IMAGE),true)
@@ -4765,7 +4773,7 @@
 
 $(INTERNAL_OTA_PACKAGE_TARGET): KEY_CERT_PAIR := $(DEFAULT_KEY_CERT_PAIR)
 $(INTERNAL_OTA_PACKAGE_TARGET): .KATI_IMPLICIT_OUTPUTS := $(INTERNAL_OTA_METADATA)
-$(INTERNAL_OTA_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) $(OTA_FROM_TARGET_FILES)
+$(INTERNAL_OTA_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) $(OTA_FROM_TARGET_FILES) $(INTERNAL_OTATOOLS_FILES)
 	@echo "Package OTA: $@"
 	$(call build-ota-package-target,$@,-k $(KEY_CERT_PAIR) --output_metadata_path $(INTERNAL_OTA_METADATA))
 
@@ -4783,7 +4791,8 @@
 $(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET): KEY_CERT_PAIR := $(DEFAULT_KEY_CERT_PAIR)
 $(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET): \
     $(BUILT_TARGET_FILES_PACKAGE) \
-    $(OTA_FROM_TARGET_FILES)
+    $(OTA_FROM_TARGET_FILES) \
+    $(INTERNAL_OTATOOLS_FILES)
 	@echo "Package OTA (retrofit dynamic partitions): $@"
 	$(call build-ota-package-target,$@,-k $(KEY_CERT_PAIR) --retrofit_dynamic_partitions)
 
diff --git a/core/OWNERS b/core/OWNERS
index 459683e..5456d4f 100644
--- a/core/OWNERS
+++ b/core/OWNERS
@@ -1,2 +1,6 @@
 per-file dex_preopt*.mk = ngeoffray@google.com,calin@google.com,mathewi@google.com,dbrazdil@google.com
 per-file verify_uses_libraries.sh = ngeoffray@google.com,calin@google.com,mathieuc@google.com
+
+# For version updates
+per-file version_defaults.mk = aseaton@google.com,elisapascual@google.com,lubomir@google.com,pscovanner@google.com
+
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 58be7a2..adf61f1 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -987,6 +987,9 @@
 ALL_MODULES.$(my_register_name).TEST_CONFIG := $(test_config)
 ALL_MODULES.$(my_register_name).EXTRA_TEST_CONFIGS := $(LOCAL_EXTRA_FULL_TEST_CONFIGS)
 ALL_MODULES.$(my_register_name).TEST_MAINLINE_MODULES := $(LOCAL_TEST_MAINLINE_MODULES)
+ifndef LOCAL_IS_HOST_MODULE
+ALL_MODULES.$(my_register_name).FILE_CONTEXTS := $(LOCAL_FILE_CONTEXTS)
+endif
 test_config :=
 
 INSTALLABLE_FILES.$(LOCAL_INSTALLED_MODULE).MODULE := $(my_register_name)
diff --git a/core/board_config.mk b/core/board_config.mk
index 95d8af8..05b6b29 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -342,23 +342,29 @@
 
 # Are we building a boot image
 BUILDING_BOOT_IMAGE :=
-ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
-  BUILDING_BOOT_IMAGE :=
-else ifeq ($(PRODUCT_BUILD_BOOT_IMAGE),)
-  ifdef BOARD_BOOTIMAGE_PARTITION_SIZE
+ifeq ($(PRODUCT_BUILD_BOOT_IMAGE),)
+  ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+    BUILDING_BOOT_IMAGE :=
+  else ifdef BOARD_BOOTIMAGE_PARTITION_SIZE
     BUILDING_BOOT_IMAGE := true
   endif
 else ifeq ($(PRODUCT_BUILD_BOOT_IMAGE),true)
-  BUILDING_BOOT_IMAGE := true
+  ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+    $(warning *** PRODUCT_BUILD_BOOT_IMAGE is true, but so is BOARD_USES_RECOVERY_AS_BOOT.)
+    $(warning *** Skipping building boot image.)
+    BUILDING_BOOT_IMAGE :=
+  else
+    BUILDING_BOOT_IMAGE := true
+  endif
 endif
 .KATI_READONLY := BUILDING_BOOT_IMAGE
 
 # Are we building a recovery image
 BUILDING_RECOVERY_IMAGE :=
-ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
-  BUILDING_RECOVERY_IMAGE := true
-else ifeq ($(PRODUCT_BUILD_RECOVERY_IMAGE),)
-  ifdef BOARD_RECOVERYIMAGE_PARTITION_SIZE
+ifeq ($(PRODUCT_BUILD_RECOVERY_IMAGE),)
+  ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+    BUILDING_RECOVERY_IMAGE := true
+  else ifdef BOARD_RECOVERYIMAGE_PARTITION_SIZE
     ifeq (,$(filter true, $(TARGET_NO_KERNEL) $(TARGET_NO_RECOVERY)))
       BUILDING_RECOVERY_IMAGE := true
     endif
@@ -372,7 +378,14 @@
 BUILDING_VENDOR_BOOT_IMAGE :=
 ifdef BOARD_BOOT_HEADER_VERSION
   ifneq ($(call math_gt_or_eq,$(BOARD_BOOT_HEADER_VERSION),3),)
-    ifneq ($(TARGET_NO_VENDOR_BOOT),true)
+    ifneq ($(TARGET_NO_VENDOR_BOOT),)
+      $(warning TARGET_NO_VENDOR_BOOT has been deprecated. Please use PRODUCT_BUILD_VENDOR_BOOT_IMAGE.)
+      ifneq ($(TARGET_NO_VENDOR_BOOT),true)
+        BUILDING_VENDOR_BOOT_IMAGE := true
+      endif
+    else ifeq ($(PRODUCT_BUILD_VENDOR_BOOT_IMAGE),)
+      BUILDING_VENDOR_BOOT_IMAGE := true
+    else ifeq ($(PRODUCT_BUILD_VENDOR_BOOT_IMAGE),true)
       BUILDING_VENDOR_BOOT_IMAGE := true
     endif
   endif
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index d515db3..7d79baf 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -102,6 +102,7 @@
 LOCAL_EXTRACT_APK:=
 LOCAL_EXTRACT_DPI_APK:=
 LOCAL_FDO_SUPPORT:=
+LOCAL_FILE_CONTEXTS:=
 LOCAL_FINDBUGS_FLAGS:=
 LOCAL_FORCE_STATIC_EXECUTABLE:=
 LOCAL_FULL_CLASSES_JACOCO_JAR:=
diff --git a/core/ninja_config.mk b/core/ninja_config.mk
index 6fccacd..2e1bd69 100644
--- a/core/ninja_config.mk
+++ b/core/ninja_config.mk
@@ -39,7 +39,6 @@
 	user \
 	userdataimage \
 	userdebug \
-	vts10 \
 	win_sdk \
 	winsdk-tools
 
diff --git a/core/notice_files.mk b/core/notice_files.mk
index 721a034..0430007 100644
--- a/core/notice_files.mk
+++ b/core/notice_files.mk
@@ -79,8 +79,9 @@
       endif
       module_installed_filename := \
           $(patsubst $(PRODUCT_OUT)/%,%,$($(my_prefix)OUT_JAVA_LIBRARIES))/$(module_leaf)
-    else ifeq ($(LOCAL_MODULE_CLASS),ETC)
-      # ETC modules may be uninstallable, yet still have a NOTICE file. e.g. apex components
+    else ifneq ($(filter ETC DATA,$(LOCAL_MODULE_CLASS)),)
+      # ETC and DATA modules may be uninstallable, yet still have a NOTICE file.
+      # e.g. apex components
       module_installed_filename :=
     else ifneq (,$(and $(filter %.sdk,$(LOCAL_MODULE)),$(filter $(patsubst %.sdk,%,$(LOCAL_MODULE)),$(SOONG_SDK_VARIANT_MODULES))))
       # Soong produces uninstallable *.sdk shared libraries for embedding in APKs.
diff --git a/core/product.mk b/core/product.mk
index 624501e..666e390 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -380,6 +380,7 @@
 _product_single_value_vars += PRODUCT_BUILD_USERDATA_IMAGE
 _product_single_value_vars += PRODUCT_BUILD_RECOVERY_IMAGE
 _product_single_value_vars += PRODUCT_BUILD_BOOT_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_VENDOR_BOOT_IMAGE
 _product_single_value_vars += PRODUCT_BUILD_VBMETA_IMAGE
 
 # List of boot jars delivered via apex
diff --git a/core/tasks/find-shareduid-violation.mk b/core/tasks/find-shareduid-violation.mk
index 86052f2..972b1ec 100644
--- a/core/tasks/find-shareduid-violation.mk
+++ b/core/tasks/find-shareduid-violation.mk
@@ -28,5 +28,13 @@
 
 $(shareduid_violation_modules_filename): $(find_shareduid_script)
 $(shareduid_violation_modules_filename): $(AAPT2)
-	$(find_shareduid_script) $(PRODUCT_OUT) $(AAPT2) > $@
+	$(find_shareduid_script) \
+		--product_out $(PRODUCT_OUT) \
+		--aapt $(AAPT2) \
+		--copy_out_system $(TARGET_COPY_OUT_SYSTEM) \
+		--copy_out_vendor $(TARGET_COPY_OUT_VENDOR) \
+		--copy_out_product $(TARGET_COPY_OUT_PRODUCT) \
+		--copy_out_system_ext $(TARGET_COPY_OUT_SYSTEM_EXT) \
+		> $@
+
 $(call dist-for-goals,droidcore,$(shareduid_violation_modules_filename))
diff --git a/core/tasks/find-shareduid-violation.py b/core/tasks/find-shareduid-violation.py
index 1f8e4df..8dba5a1 100755
--- a/core/tasks/find-shareduid-violation.py
+++ b/core/tasks/find-shareduid-violation.py
@@ -14,19 +14,31 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+import argparse
+import json
 import os
 import subprocess
-from glob import glob
-from collections import defaultdict
 import sys
-import json
 
-if len(sys.argv) < 3:
-    product_out = os.environ["PRODUCT_OUT"]
-    aapt = "aapt2"
-else:
-    product_out = sys.argv[1]
-    aapt = sys.argv[2]
+from collections import defaultdict
+from glob import glob
+
+def parse_args():
+    """Parse commandline arguments."""
+    parser = argparse.ArgumentParser(description='Find sharedUserId violators')
+    parser.add_argument('--product_out', help='PRODUCT_OUT directory',
+                        default=os.environ.get("PRODUCT_OUT"))
+    parser.add_argument('--aapt', help='Path to aapt or aapt2',
+                        default="aapt2")
+    parser.add_argument('--copy_out_system', help='TARGET_COPY_OUT_SYSTEM',
+                        default="system")
+    parser.add_argument('--copy_out_vendor', help='TARGET_COPY_OUT_VENDOR',
+                        default="vendor")
+    parser.add_argument('--copy_out_product', help='TARGET_COPY_OUT_PRODUCT',
+                        default="product")
+    parser.add_argument('--copy_out_system_ext', help='TARGET_COPY_OUT_SYSTEM_EXT',
+                        default="system_ext")
+    return parser.parse_args()
 
 def execute(cmd):
     p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
@@ -45,7 +57,6 @@
     else:
         print(error_msg, file=sys.stderr)
         sys.exit()
-        return None
 
     for l in manifest.split('\n'):
         if "sharedUserId" in l:
@@ -53,18 +64,28 @@
     return None
 
 
-partitions = ["system", "vendor", "product"]
+args = parse_args()
+
+product_out = args.product_out
+aapt = args.aapt
+
+partitions = (
+        ("system", args.copy_out_system),
+        ("vendor", args.copy_out_vendor),
+        ("product", args.copy_out_product),
+        ("system_ext", args.copy_out_system_ext),
+)
 
 shareduid_app_dict = defaultdict(list)
 
-for p in partitions:
-    for f in glob(os.path.join(product_out, p, "*", "*", "*.apk")):
+for part, location in partitions:
+    for f in glob(os.path.join(product_out, location, "*", "*", "*.apk")):
         apk_file = os.path.basename(f)
         shared_uid = extract_shared_uid(f)
 
         if shared_uid is None:
             continue
-        shareduid_app_dict[shared_uid].append((p, apk_file))
+        shareduid_app_dict[shared_uid].append((part, apk_file))
 
 
 output = defaultdict(lambda: defaultdict(list))
diff --git a/core/tasks/tools/vts_package_utils.mk b/core/tasks/tools/vts_package_utils.mk
new file mode 100644
index 0000000..47bf29c
--- /dev/null
+++ b/core/tasks/tools/vts_package_utils.mk
@@ -0,0 +1,33 @@
+#
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# $(1): List of target native files to copy.
+# $(2): Copy destination directory.
+# Evaluates to a list of ":"-separated pairs src:dst.
+define target-native-copy-pairs
+$(foreach m,$(1),\
+  $(eval _built_files := $(strip $(ALL_MODULES.$(m).BUILT_INSTALLED)\
+  $(ALL_MODULES.$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX).BUILT_INSTALLED)))\
+  $(foreach i, $(_built_files),\
+    $(eval bui_ins := $(subst :,$(space),$(i)))\
+    $(eval ins := $(word 2,$(bui_ins)))\
+    $(if $(filter $(TARGET_OUT_ROOT)/%,$(ins)),\
+      $(eval bui := $(word 1,$(bui_ins)))\
+      $(eval my_copy_dest := $(patsubst data/%,DATA/%,\
+                               $(patsubst system/%,DATA/%,\
+                                   $(patsubst $(PRODUCT_OUT)/%,%,$(ins)))))\
+      $(bui):$(2)/$(my_copy_dest))))
+endef
diff --git a/core/tasks/vts-core-tests.mk b/core/tasks/vts-core-tests.mk
index a3247da..95c4d24 100644
--- a/core/tasks/vts-core-tests.mk
+++ b/core/tasks/vts-core-tests.mk
@@ -15,6 +15,8 @@
 -include external/linux-kselftest/android/kselftest_test_list.mk
 -include external/ltp/android/ltp_package_list.mk
 
+include $(BUILD_SYSTEM)/tasks/tools/vts_package_utils.mk
+
 test_suite_name := vts
 test_suite_tradefed := vts-tradefed
 test_suite_readme := test/vts/tools/vts-core-tradefed/README
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index b507ca9..41696e8 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -240,7 +240,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2020-09-05
+      PLATFORM_SECURITY_PATCH := 2020-10-05
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
diff --git a/target/board/emulator_arm64/BoardConfig.mk b/target/board/emulator_arm64/BoardConfig.mk
index b34ccb4..a17cb75 100644
--- a/target/board/emulator_arm64/BoardConfig.mk
+++ b/target/board/emulator_arm64/BoardConfig.mk
@@ -23,7 +23,7 @@
 TARGET_2ND_CPU_ABI := armeabi-v7a
 TARGET_2ND_CPU_ABI2 := armeabi
 
-ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk vts10,$(MAKECMDGOALS)),)
+ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk,$(MAKECMDGOALS)),)
 # DO NOT USE
 # DO NOT USE
 #
diff --git a/target/board/emulator_arm64/device.mk b/target/board/emulator_arm64/device.mk
index 73dc2f4..dc84192 100644
--- a/target/board/emulator_arm64/device.mk
+++ b/target/board/emulator_arm64/device.mk
@@ -19,7 +19,7 @@
 
 # Cuttlefish has GKI kernel prebuilts, so use those for the GKI boot.img.
 ifeq ($(TARGET_PREBUILT_KERNEL),)
-    LOCAL_KERNEL := device/google/cuttlefish_kernel/5.4-arm64/kernel
+    LOCAL_KERNEL := kernel/prebuilts/5.4/arm64/kernel-5.4-lz4
 else
     LOCAL_KERNEL := $(TARGET_PREBUILT_KERNEL)
 endif
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index c45a8ab..d5331ad 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -23,7 +23,7 @@
 TARGET_2ND_CPU_ABI := armeabi-v7a
 TARGET_2ND_CPU_ABI2 := armeabi
 
-ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk vts10,$(MAKECMDGOALS)),)
+ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk,$(MAKECMDGOALS)),)
 # DO NOT USE
 # DO NOT USE
 #
diff --git a/target/board/generic_arm64/device.mk b/target/board/generic_arm64/device.mk
index 1585fbd..6f1bba0 100644
--- a/target/board/generic_arm64/device.mk
+++ b/target/board/generic_arm64/device.mk
@@ -16,16 +16,16 @@
 
 PRODUCT_COPY_FILES += \
     kernel/prebuilts/4.19/arm64/Image.gz:kernel-4.19-gz \
-    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4:kernel-5.4 \
-    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-gz:kernel-5.4-gz \
-    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-lz4:kernel-5.4-lz4 \
-    kernel/prebuilts/mainline/arm64/kernel-mainline:kernel-mainline \
-    kernel/prebuilts/mainline/arm64/kernel-mainline-gz:kernel-mainline-gz \
-    kernel/prebuilts/mainline/arm64/kernel-mainline-lz4:kernel-mainline-lz4
+    kernel/prebuilts/5.4/arm64/kernel-5.4:kernel-5.4 \
+    kernel/prebuilts/5.4/arm64/kernel-5.4-gz:kernel-5.4-gz \
+    kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4 \
+    kernel/prebuilts/mainline/arm64/kernel-mainline-allsyms:kernel-mainline \
+    kernel/prebuilts/mainline/arm64/kernel-mainline-gz-allsyms:kernel-mainline-gz \
+    kernel/prebuilts/mainline/arm64/kernel-mainline-lz4-allsyms:kernel-mainline-lz4
 
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
 PRODUCT_COPY_FILES += \
-    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4:kernel-5.4-allsyms \
-    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-gz:kernel-5.4-gz-allsyms \
-    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-lz4:kernel-5.4-lz4-allsyms
+    kernel/prebuilts/5.4/arm64/kernel-5.4:kernel-5.4-allsyms \
+    kernel/prebuilts/5.4/arm64/kernel-5.4-gz:kernel-5.4-gz-allsyms \
+    kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4-allsyms
 endif
diff --git a/target/product/base_product.mk b/target/product/base_product.mk
index 2ed550c..0166ecc 100644
--- a/target/product/base_product.mk
+++ b/target/product/base_product.mk
@@ -21,3 +21,4 @@
     passwd_product \
     product_compatibility_matrix.xml \
     product_manifest.xml \
+    selinux_policy_product \
diff --git a/target/product/base_system_ext.mk b/target/product/base_system_ext.mk
index b67549a..58921d8 100644
--- a/target/product/base_system_ext.mk
+++ b/target/product/base_system_ext.mk
@@ -19,3 +19,4 @@
     group_system_ext \
     system_ext_manifest.xml \
     passwd_system_ext \
+    selinux_policy_system_ext \
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index baf1382..de6644c 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -79,6 +79,7 @@
 VNDK-core: android.hardware.vibrator-V1-ndk_platform.so
 VNDK-core: android.hidl.token@1.0-utils.so
 VNDK-core: android.hidl.token@1.0.so
+VNDK-core: android.system.keystore2-V1-ndk_platform.so
 VNDK-core: android.system.suspend@1.0.so
 VNDK-core: libadf.so
 VNDK-core: libaudioroute.so
diff --git a/tools/releasetools/apex_utils.py b/tools/releasetools/apex_utils.py
index 8783f25..3eb5196 100644
--- a/tools/releasetools/apex_utils.py
+++ b/tools/releasetools/apex_utils.py
@@ -177,7 +177,7 @@
 
     # Add the payload image back to the apex file.
     common.ZipDelete(self.apex_path, APEX_PAYLOAD_IMAGE)
-    with zipfile.ZipFile(self.apex_path, 'a') as output_apex:
+    with zipfile.ZipFile(self.apex_path, 'a', allowZip64=True) as output_apex:
       common.ZipWrite(output_apex, payload_img, APEX_PAYLOAD_IMAGE,
                       compress_type=zipfile.ZIP_STORED)
     return self.apex_path
@@ -351,7 +351,7 @@
   common.ZipDelete(apex_file, APEX_PAYLOAD_IMAGE)
   if APEX_PUBKEY in zip_items:
     common.ZipDelete(apex_file, APEX_PUBKEY)
-  apex_zip = zipfile.ZipFile(apex_file, 'a')
+  apex_zip = zipfile.ZipFile(apex_file, 'a', allowZip64=True)
   common.ZipWrite(apex_zip, payload_file, arcname=APEX_PAYLOAD_IMAGE)
   common.ZipWrite(apex_zip, payload_public_key, arcname=APEX_PUBKEY)
   common.ZipClose(apex_zip)
diff --git a/tools/releasetools/check_ota_package_signature.py b/tools/releasetools/check_ota_package_signature.py
index 0d990f1..58510a5 100755
--- a/tools/releasetools/check_ota_package_signature.py
+++ b/tools/releasetools/check_ota_package_signature.py
@@ -140,7 +140,7 @@
 
 def VerifyAbOtaPayload(cert, package):
   """Verifies the payload and metadata signatures in an A/B OTA payload."""
-  package_zip = zipfile.ZipFile(package, 'r')
+  package_zip = zipfile.ZipFile(package, 'r', allowZip64=True)
   if 'payload.bin' not in package_zip.namelist():
     common.ZipClose(package_zip)
     return
diff --git a/tools/releasetools/check_target_files_vintf.py b/tools/releasetools/check_target_files_vintf.py
index 0edefac..3c2406c 100755
--- a/tools/releasetools/check_target_files_vintf.py
+++ b/tools/releasetools/check_target_files_vintf.py
@@ -252,7 +252,7 @@
     if os.path.isdir(target_files):
       return os.path.isdir(os.path.join(target_files, "VENDOR"))
     if zipfile.is_zipfile(target_files):
-      return HasPartition(zipfile.ZipFile(target_files), "vendor")
+      return HasPartition(zipfile.ZipFile(target_files, allowZip64=True), "vendor")
     raise ValueError("Unknown target_files argument")
 
   return (HasVendorPartition(target_files) and
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index c77d8c6..f5dfbec 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -1568,7 +1568,7 @@
   cmd = ["unzip", "-o", "-q", filename, "-d", dirname]
   if patterns is not None:
     # Filter out non-matching patterns. unzip will complain otherwise.
-    with zipfile.ZipFile(filename) as input_zip:
+    with zipfile.ZipFile(filename, allowZip64=True) as input_zip:
       names = input_zip.namelist()
     filtered = [
         pattern for pattern in patterns if fnmatch.filter(names, pattern)]
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index 2833397..18b2b76 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -656,7 +656,7 @@
   target_file = common.MakeTempFile(prefix="targetfiles-", suffix=".zip")
   target_zip = zipfile.ZipFile(target_file, 'w', allowZip64=True)
 
-  with zipfile.ZipFile(input_file, 'r') as input_zip:
+  with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
     infolist = input_zip.infolist()
 
   input_tmp = common.UnzipTemp(input_file, UNZIP_PATTERN)
@@ -719,7 +719,7 @@
     The filename of target-files.zip that doesn't contain postinstall config.
   """
   # We should only make a copy if postinstall_config entry exists.
-  with zipfile.ZipFile(input_file, 'r') as input_zip:
+  with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
     if POSTINSTALL_CONFIG not in input_zip.namelist():
       return input_file
 
@@ -754,7 +754,7 @@
   target_file = common.MakeTempFile(prefix="targetfiles-", suffix=".zip")
   shutil.copyfile(input_file, target_file)
 
-  with zipfile.ZipFile(input_file) as input_zip:
+  with zipfile.ZipFile(input_file, allowZip64=True) as input_zip:
     namelist = input_zip.namelist()
 
   input_tmp = common.UnzipTemp(input_file, RETROFIT_DAP_UNZIP_PATTERN)
@@ -822,7 +822,7 @@
   else:
     staging_file = output_file
   output_zip = zipfile.ZipFile(staging_file, "w",
-                               compression=zipfile.ZIP_DEFLATED)
+                               compression=zipfile.ZIP_DEFLATED, allowZip64=True)
 
   if source_file is not None:
     assert "ab_partitions" in OPTIONS.source_info_dict, \
@@ -893,7 +893,7 @@
 
   # If dm-verity is supported for the device, copy contents of care_map
   # into A/B OTA package.
-  target_zip = zipfile.ZipFile(target_file, "r")
+  target_zip = zipfile.ZipFile(target_file, "r", allowZip64=True)
   if (target_info.get("verity") == "true" or
           target_info.get("avb_enable") == "true"):
     care_map_list = [x for x in ["care_map.pb", "care_map.txt"] if
@@ -1069,7 +1069,7 @@
   if OPTIONS.extracted_input is not None:
     OPTIONS.info_dict = common.LoadInfoDict(OPTIONS.extracted_input)
   else:
-    with zipfile.ZipFile(args[0], 'r') as input_zip:
+    with zipfile.ZipFile(args[0], 'r', allowZip64=True) as input_zip:
       OPTIONS.info_dict = common.LoadInfoDict(input_zip)
 
   logger.info("--- target info ---")
@@ -1078,7 +1078,7 @@
   # Load the source build dict if applicable.
   if OPTIONS.incremental_source is not None:
     OPTIONS.target_info_dict = OPTIONS.info_dict
-    with zipfile.ZipFile(OPTIONS.incremental_source, 'r') as source_zip:
+    with zipfile.ZipFile(OPTIONS.incremental_source, 'r', allowZip64=True) as source_zip:
       OPTIONS.source_info_dict = common.LoadInfoDict(source_zip)
 
     logger.info("--- source info ---")
diff --git a/tools/releasetools/ota_package_parser.py b/tools/releasetools/ota_package_parser.py
index 331122b..1e733b9 100755
--- a/tools/releasetools/ota_package_parser.py
+++ b/tools/releasetools/ota_package_parser.py
@@ -215,7 +215,7 @@
   logging.basicConfig(level=logging.INFO, format=logging_format)
 
   try:
-    with zipfile.ZipFile(args.ota_package, 'r') as package:
+    with zipfile.ZipFile(args.ota_package, 'r', allowZip64=True) as package:
       package_parser = OtaPackageParser(package)
       package_parser.Analyze()
   except:
diff --git a/tools/releasetools/ota_utils.py b/tools/releasetools/ota_utils.py
index d444d41..f0e4fcf 100644
--- a/tools/releasetools/ota_utils.py
+++ b/tools/releasetools/ota_utils.py
@@ -62,7 +62,7 @@
 
   def ComputeAllPropertyFiles(input_file, needed_property_files):
     # Write the current metadata entry with placeholders.
-    with zipfile.ZipFile(input_file) as input_zip:
+    with zipfile.ZipFile(input_file, allowZip64=True) as input_zip:
       for property_files in needed_property_files:
         metadata.property_files[property_files.name] = property_files.Compute(
             input_zip)
@@ -70,7 +70,7 @@
 
     if METADATA_NAME in namelist or METADATA_PROTO_NAME in namelist:
       ZipDelete(input_file, [METADATA_NAME, METADATA_PROTO_NAME])
-    output_zip = zipfile.ZipFile(input_file, 'a')
+    output_zip = zipfile.ZipFile(input_file, 'a', allowZip64=True)
     WriteMetadata(metadata, output_zip)
     ZipClose(output_zip)
 
@@ -82,7 +82,7 @@
     return prelim_signing
 
   def FinalizeAllPropertyFiles(prelim_signing, needed_property_files):
-    with zipfile.ZipFile(prelim_signing) as prelim_signing_zip:
+    with zipfile.ZipFile(prelim_signing, allowZip64=True) as prelim_signing_zip:
       for property_files in needed_property_files:
         metadata.property_files[property_files.name] = property_files.Finalize(
             prelim_signing_zip,
@@ -108,7 +108,7 @@
 
   # Replace the METADATA entry.
   ZipDelete(prelim_signing, [METADATA_NAME, METADATA_PROTO_NAME])
-  output_zip = zipfile.ZipFile(prelim_signing, 'a')
+  output_zip = zipfile.ZipFile(prelim_signing, 'a', allowZip64=True)
   WriteMetadata(metadata, output_zip)
   ZipClose(output_zip)
 
@@ -119,7 +119,7 @@
     SignOutput(prelim_signing, output_file)
 
   # Reopen the final signed zip to double check the streaming metadata.
-  with zipfile.ZipFile(output_file) as output_zip:
+  with zipfile.ZipFile(output_file, allowZip64=True) as output_zip:
     for property_files in needed_property_files:
       property_files.Verify(
           output_zip, metadata.property_files[property_files.name].strip())
@@ -363,7 +363,7 @@
       partition_prop_key = "{}.build.prop".format(partition)
       input_file = info_dict[partition_prop_key].input_file
       if isinstance(input_file, zipfile.ZipFile):
-        with zipfile.ZipFile(input_file.filename) as input_zip:
+        with zipfile.ZipFile(input_file.filename, allowZip64=True) as input_zip:
           info_dict[partition_prop_key] = \
               PartitionBuildProps.FromInputFile(input_zip, partition,
                                                 placeholder_values)
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index b4646b7..220f519 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -813,7 +813,7 @@
     keys: A list of public keys to use during OTA package verification.
   """
   temp_file = io.BytesIO()
-  certs_zip = zipfile.ZipFile(temp_file, "w")
+  certs_zip = zipfile.ZipFile(temp_file, "w", allowZip64=True)
   for k in keys:
     common.ZipWrite(certs_zip, k)
   common.ZipClose(certs_zip)
@@ -1294,7 +1294,7 @@
 
   common.InitLogging()
 
-  input_zip = zipfile.ZipFile(args[0], "r")
+  input_zip = zipfile.ZipFile(args[0], "r", allowZip64=True)
   output_zip = zipfile.ZipFile(args[1], "w",
                                compression=zipfile.ZIP_DEFLATED,
                                allowZip64=True)
diff --git a/tools/releasetools/test_add_img_to_target_files.py b/tools/releasetools/test_add_img_to_target_files.py
index efa60b6..6b7a7db 100644
--- a/tools/releasetools/test_add_img_to_target_files.py
+++ b/tools/releasetools/test_add_img_to_target_files.py
@@ -93,10 +93,10 @@
 
     # Set up the output zip.
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       AddPackRadioImages(output_zip, images)
 
-    with zipfile.ZipFile(output_file, 'r') as verify_zip:
+    with zipfile.ZipFile(output_file, 'r', allowZip64=True) as verify_zip:
       for image in images:
         self.assertIn('IMAGES/' + image + '.img', verify_zip.namelist())
 
@@ -344,12 +344,12 @@
     image_paths = self._test_AddCareMapForAbOta()
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       AddCareMapForAbOta(output_zip, ['system', 'vendor'], image_paths)
 
     care_map_name = "META/care_map.pb"
     temp_dir = common.MakeTempDir()
-    with zipfile.ZipFile(output_file, 'r') as verify_zip:
+    with zipfile.ZipFile(output_file, 'r', allowZip64=True) as verify_zip:
       self.assertTrue(care_map_name in verify_zip.namelist())
       verify_zip.extract(care_map_name, path=temp_dir)
 
@@ -367,7 +367,7 @@
     image_paths = self._test_AddCareMapForAbOta()
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       # Create an existing META/care_map.pb entry.
       common.ZipWriteStr(output_zip, 'META/care_map.pb',
                          'fake care_map.pb')
diff --git a/tools/releasetools/test_apex_utils.py b/tools/releasetools/test_apex_utils.py
index 339ddc7..71f6433 100644
--- a/tools/releasetools/test_apex_utils.py
+++ b/tools/releasetools/test_apex_utils.py
@@ -174,8 +174,8 @@
   @test_utils.SkipIfExternalToolsUnavailable()
   def test_ApexApkSigner_noAssetDir(self):
     no_asset = common.MakeTempFile(suffix='.apex')
-    with zipfile.ZipFile(no_asset, 'w') as output_zip:
-      with zipfile.ZipFile(self.apex_with_apk, 'r') as input_zip:
+    with zipfile.ZipFile(no_asset, 'w', allowZip64=True) as output_zip:
+      with zipfile.ZipFile(self.apex_with_apk, 'r', allowZip64=True) as input_zip:
         name_list = input_zip.namelist()
         for name in name_list:
           if not name.startswith('assets'):
diff --git a/tools/releasetools/test_common.py b/tools/releasetools/test_common.py
index 81ee53d..22fc85a 100644
--- a/tools/releasetools/test_common.py
+++ b/tools/releasetools/test_common.py
@@ -363,7 +363,7 @@
       self.assertEqual(int(expected_stat.st_mtime), int(new_stat.st_mtime))
 
     # Reopen the zip file to verify.
-    zip_file = zipfile.ZipFile(zip_file_name, "r")
+    zip_file = zipfile.ZipFile(zip_file_name, "r", allowZip64=True)
 
     # Verify the timestamp.
     info = zip_file.getinfo(arcname)
@@ -399,7 +399,7 @@
       arcname = arcname[1:]
 
     zip_file.close()
-    zip_file = zipfile.ZipFile(zip_file_name, "w")
+    zip_file = zipfile.ZipFile(zip_file_name, "w", allowZip64=True)
 
     try:
       sha1_hash = sha1()
@@ -431,7 +431,7 @@
     zip_file_name = zip_file.name
     zip_file.close()
 
-    zip_file = zipfile.ZipFile(zip_file_name, "w")
+    zip_file = zipfile.ZipFile(zip_file_name, "w", allowZip64=True)
 
     try:
       expected_compress_type = extra_args.get("compress_type",
@@ -475,7 +475,7 @@
       arcname_large = arcname_large[1:]
 
     zip_file.close()
-    zip_file = zipfile.ZipFile(zip_file_name, "w")
+    zip_file = zipfile.ZipFile(zip_file_name, "w", allowZip64=True)
 
     try:
       sha1_hash = sha1()
@@ -599,7 +599,7 @@
 
     try:
       random_string = os.urandom(1024)
-      zip_file = zipfile.ZipFile(zip_file_name, "w")
+      zip_file = zipfile.ZipFile(zip_file_name, "w", allowZip64=True)
       # Default perms should be 0o644 when passing the filename.
       common.ZipWriteStr(zip_file, "foo", random_string)
       # Honor the specified perms.
@@ -644,7 +644,7 @@
 
     try:
       common.ZipDelete(zip_file.name, 'Test2')
-      with zipfile.ZipFile(zip_file.name, 'r') as check_zip:
+      with zipfile.ZipFile(zip_file.name, 'r', allowZip64=True) as check_zip:
         entries = check_zip.namelist()
         self.assertTrue('Test1' in entries)
         self.assertFalse('Test2' in entries)
@@ -652,21 +652,21 @@
 
       self.assertRaises(
           common.ExternalError, common.ZipDelete, zip_file.name, 'Test2')
-      with zipfile.ZipFile(zip_file.name, 'r') as check_zip:
+      with zipfile.ZipFile(zip_file.name, 'r', allowZip64=True) as check_zip:
         entries = check_zip.namelist()
         self.assertTrue('Test1' in entries)
         self.assertFalse('Test2' in entries)
         self.assertTrue('Test3' in entries)
 
       common.ZipDelete(zip_file.name, ['Test3'])
-      with zipfile.ZipFile(zip_file.name, 'r') as check_zip:
+      with zipfile.ZipFile(zip_file.name, 'r', allowZip64=True) as check_zip:
         entries = check_zip.namelist()
         self.assertTrue('Test1' in entries)
         self.assertFalse('Test2' in entries)
         self.assertFalse('Test3' in entries)
 
       common.ZipDelete(zip_file.name, ['Test1', 'Test2'])
-      with zipfile.ZipFile(zip_file.name, 'r') as check_zip:
+      with zipfile.ZipFile(zip_file.name, 'r', allowZip64=True) as check_zip:
         entries = check_zip.namelist()
         self.assertFalse('Test1' in entries)
         self.assertFalse('Test2' in entries)
@@ -834,7 +834,7 @@
     if additional is None:
       additional = []
     target_files = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.writestr('META/apkcerts.txt', apkcerts_txt)
       for entry in additional:
         target_files_zip.writestr(entry, '')
@@ -842,7 +842,7 @@
 
   def test_ReadApkCerts_NoncompressedApks(self):
     target_files = self._write_apkcerts_txt(self.APKCERTS_TXT1)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       certmap, ext = common.ReadApkCerts(input_zip)
 
     self.assertDictEqual(self.APKCERTS_CERTMAP1, certmap)
@@ -855,7 +855,7 @@
         self.APKCERTS_TXT2,
         ['Compressed1.apk.gz', 'Compressed3.apk'])
 
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       certmap, ext = common.ReadApkCerts(input_zip)
 
     self.assertDictEqual(self.APKCERTS_CERTMAP2, certmap)
@@ -865,7 +865,7 @@
     target_files = self._write_apkcerts_txt(
         self.APKCERTS_TXT3, ['Compressed4.apk.xz'])
 
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       certmap, ext = common.ReadApkCerts(input_zip)
 
     self.assertDictEqual(self.APKCERTS_CERTMAP3, certmap)
@@ -876,7 +876,7 @@
         self.APKCERTS_TXT1 + self.APKCERTS_TXT2,
         ['Compressed1.apk.gz', 'Compressed3.apk'])
 
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       certmap, ext = common.ReadApkCerts(input_zip)
 
     certmap_merged = self.APKCERTS_CERTMAP1.copy()
@@ -889,7 +889,7 @@
         self.APKCERTS_TXT2 + self.APKCERTS_TXT3,
         ['Compressed1.apk.gz', 'Compressed4.apk.xz'])
 
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       self.assertRaises(ValueError, common.ReadApkCerts, input_zip)
 
   def test_ReadApkCerts_MismatchingKeys(self):
@@ -899,12 +899,12 @@
     )
     target_files = self._write_apkcerts_txt(malformed_apkcerts_txt)
 
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       self.assertRaises(ValueError, common.ReadApkCerts, input_zip)
 
   def test_ReadApkCerts_WithWithoutOptionalFields(self):
     target_files = self._write_apkcerts_txt(self.APKCERTS_TXT4)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       certmap, ext = common.ReadApkCerts(input_zip)
 
     self.assertDictEqual(self.APKCERTS_CERTMAP4, certmap)
@@ -973,7 +973,7 @@
   @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_emptyBlockMapFile(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.write(
           test_utils.construct_sparse_image([
               (0xCAC1, 6),
@@ -985,7 +985,7 @@
       target_files_zip.writestr('SYSTEM/file2', os.urandom(4096 * 3))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, False)
 
     self.assertDictEqual(
@@ -1006,7 +1006,7 @@
   @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_missingBlockMapFile(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.write(
           test_utils.construct_sparse_image([
               (0xCAC1, 6),
@@ -1017,7 +1017,7 @@
       target_files_zip.writestr('SYSTEM/file2', os.urandom(4096 * 3))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       self.assertRaises(
           AssertionError, common.GetSparseImage, 'system', tempdir, input_zip,
           False)
@@ -1026,7 +1026,7 @@
   def test_GetSparseImage_sharedBlocks_notAllowed(self):
     """Tests the case of having overlapping blocks but disallowed."""
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.write(
           test_utils.construct_sparse_image([(0xCAC2, 16)]),
           arcname='IMAGES/system.img')
@@ -1040,7 +1040,7 @@
       target_files_zip.writestr('SYSTEM/file2', os.urandom(4096 * 3))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       self.assertRaises(
           AssertionError, common.GetSparseImage, 'system', tempdir, input_zip,
           False)
@@ -1049,7 +1049,7 @@
   def test_GetSparseImage_sharedBlocks_allowed(self):
     """Tests the case for target using BOARD_EXT4_SHARE_DUP_BLOCKS := true."""
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       # Construct an image with a care_map of "0-5 9-12".
       target_files_zip.write(
           test_utils.construct_sparse_image([(0xCAC2, 16)]),
@@ -1064,7 +1064,7 @@
       target_files_zip.writestr('SYSTEM/file2', os.urandom(4096 * 3))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, True)
 
     self.assertDictEqual(
@@ -1094,7 +1094,7 @@
   def test_GetSparseImage_incompleteRanges(self):
     """Tests the case of ext4 images with holes."""
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.write(
           test_utils.construct_sparse_image([(0xCAC2, 16)]),
           arcname='IMAGES/system.img')
@@ -1108,7 +1108,7 @@
       target_files_zip.writestr('SYSTEM/file2', os.urandom(4096 * 3))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, False)
 
     self.assertEqual(
@@ -1119,7 +1119,7 @@
   @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_systemRootImage_filenameWithExtraLeadingSlash(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.write(
           test_utils.construct_sparse_image([(0xCAC2, 16)]),
           arcname='IMAGES/system.img')
@@ -1136,7 +1136,7 @@
       target_files_zip.writestr('SYSTEM/app/file3', os.urandom(4096 * 4))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, False)
 
     self.assertEqual(
@@ -1149,7 +1149,7 @@
   @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_systemRootImage_nonSystemFiles(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.write(
           test_utils.construct_sparse_image([(0xCAC2, 16)]),
           arcname='IMAGES/system.img')
@@ -1163,7 +1163,7 @@
       target_files_zip.writestr('ROOT/init.rc', os.urandom(4096 * 4))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, False)
 
     self.assertEqual(
@@ -1174,7 +1174,7 @@
   @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_fileNotFound(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.write(
           test_utils.construct_sparse_image([(0xCAC2, 16)]),
           arcname='IMAGES/system.img')
@@ -1186,7 +1186,7 @@
       target_files_zip.writestr('SYSTEM/file1', os.urandom(4096 * 7))
 
     tempdir = common.UnzipTemp(target_files)
-    with zipfile.ZipFile(target_files, 'r') as input_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as input_zip:
       self.assertRaises(
           AssertionError, common.GetSparseImage, 'system', tempdir, input_zip,
           False)
@@ -1274,7 +1274,7 @@
   @staticmethod
   def _test_LoadInfoDict_createTargetFiles(info_dict, fstab_path):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       info_values = ''.join(
           ['{}={}\n'.format(k, v) for k, v in sorted(info_dict.items())])
       common.ZipWriteStr(target_files_zip, 'META/misc_info.txt', info_values)
@@ -1294,7 +1294,7 @@
     target_files = self._test_LoadInfoDict_createTargetFiles(
         self.INFO_DICT_DEFAULT,
         'BOOT/RAMDISK/system/etc/recovery.fstab')
-    with zipfile.ZipFile(target_files, 'r') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as target_files_zip:
       loaded_dict = common.LoadInfoDict(target_files_zip)
       self.assertEqual(3, loaded_dict['recovery_api_version'])
       self.assertEqual(2, loaded_dict['fstab_version'])
@@ -1305,7 +1305,7 @@
     target_files = self._test_LoadInfoDict_createTargetFiles(
         self.INFO_DICT_DEFAULT,
         'BOOT/RAMDISK/etc/recovery.fstab')
-    with zipfile.ZipFile(target_files, 'r') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as target_files_zip:
       loaded_dict = common.LoadInfoDict(target_files_zip)
       self.assertEqual(3, loaded_dict['recovery_api_version'])
       self.assertEqual(2, loaded_dict['fstab_version'])
@@ -1346,7 +1346,7 @@
     target_files = self._test_LoadInfoDict_createTargetFiles(
         info_dict,
         'RECOVERY/RAMDISK/system/etc/recovery.fstab')
-    with zipfile.ZipFile(target_files, 'r') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as target_files_zip:
       loaded_dict = common.LoadInfoDict(target_files_zip)
       self.assertEqual(3, loaded_dict['recovery_api_version'])
       self.assertEqual(2, loaded_dict['fstab_version'])
@@ -1362,7 +1362,7 @@
     target_files = self._test_LoadInfoDict_createTargetFiles(
         info_dict,
         'RECOVERY/RAMDISK/system/etc/recovery.fstab')
-    with zipfile.ZipFile(target_files, 'r') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as target_files_zip:
       loaded_dict = common.LoadInfoDict(target_files_zip)
       self.assertEqual(3, loaded_dict['recovery_api_version'])
       self.assertEqual(2, loaded_dict['fstab_version'])
@@ -1376,7 +1376,7 @@
     target_files = self._test_LoadInfoDict_createTargetFiles(
         info_dict,
         'RECOVERY/RAMDISK/system/etc/recovery.fstab')
-    with zipfile.ZipFile(target_files, 'r') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as target_files_zip:
       loaded_dict = common.LoadInfoDict(target_files_zip)
       self.assertEqual(3, loaded_dict['recovery_api_version'])
       self.assertEqual(2, loaded_dict['fstab_version'])
@@ -1388,7 +1388,7 @@
         self.INFO_DICT_DEFAULT,
         'BOOT/RAMDISK/system/etc/recovery.fstab')
     common.ZipDelete(target_files, 'META/misc_info.txt')
-    with zipfile.ZipFile(target_files, 'r') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as target_files_zip:
       self.assertRaises(ValueError, common.LoadInfoDict, target_files_zip)
 
   @test_utils.SkipIfExternalToolsUnavailable()
@@ -1412,7 +1412,7 @@
     target_files = self._test_LoadInfoDict_createTargetFiles(
         self.INFO_DICT_DEFAULT,
         'BOOT/RAMDISK/system/etc/recovery.fstab')
-    with zipfile.ZipFile(target_files, 'r') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'r', allowZip64=True) as target_files_zip:
       self.assertRaises(
           AssertionError, common.LoadInfoDict, target_files_zip, True)
 
@@ -1704,7 +1704,7 @@
 
   @staticmethod
   def get_op_list(output_path):
-    with zipfile.ZipFile(output_path) as output_zip:
+    with zipfile.ZipFile(output_path, allowZip64=True) as output_zip:
       with output_zip.open('dynamic_partitions_op_list') as op_list:
         return [line.decode().strip() for line in op_list.readlines()
                 if not line.startswith(b'#')]
@@ -1724,7 +1724,7 @@
                    MockBlockDifference("vendor", FakeSparseImage(1 * GiB))]
 
     dp_diff = common.DynamicPartitionsDifference(target_info, block_diffs)
-    with zipfile.ZipFile(self.output_path, 'w') as output_zip:
+    with zipfile.ZipFile(self.output_path, 'w', allowZip64=True) as output_zip:
       dp_diff.WriteScript(self.script, output_zip, write_verify_script=True)
 
     self.assertEqual(str(self.script).strip(), """
@@ -1772,7 +1772,7 @@
     dp_diff = common.DynamicPartitionsDifference(target_info,
                                                  block_diffs=[],
                                                  source_info_dict=source_info)
-    with zipfile.ZipFile(self.output_path, 'w') as output_zip:
+    with zipfile.ZipFile(self.output_path, 'w', allowZip64=True) as output_zip:
       dp_diff.WriteScript(self.script, output_zip, write_verify_script=True)
 
     lines = self.get_op_list(self.output_path)
@@ -1816,7 +1816,7 @@
 
     dp_diff = common.DynamicPartitionsDifference(target_info, block_diffs,
                                                  source_info_dict=source_info)
-    with zipfile.ZipFile(self.output_path, 'w') as output_zip:
+    with zipfile.ZipFile(self.output_path, 'w', allowZip64=True) as output_zip:
       dp_diff.WriteScript(self.script, output_zip, write_verify_script=True)
 
     metadata_idx = self.script.lines.index(
@@ -1887,7 +1887,7 @@
 
     dp_diff = common.DynamicPartitionsDifference(target_info, block_diffs,
                                                  source_info_dict=source_info)
-    with zipfile.ZipFile(self.output_path, 'w') as output_zip:
+    with zipfile.ZipFile(self.output_path, 'w', allowZip64=True) as output_zip:
       dp_diff.WriteScript(self.script, output_zip, write_verify_script=True)
 
     self.assertNotIn("block_image_update", str(self.script),
@@ -1910,7 +1910,7 @@
   @staticmethod
   def _BuildZipFile(entries):
     input_file = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-    with zipfile.ZipFile(input_file, 'w') as input_zip:
+    with zipfile.ZipFile(input_file, 'w', allowZip64=True) as input_zip:
       for name, content in entries.items():
         input_zip.writestr(name, content)
 
@@ -1927,7 +1927,7 @@
         'ODM/etc/build.prop': '\n'.join(build_prop),
     })
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       placeholder_values = {
           'ro.boot.product.device_name': ['std', 'pro']
       }
@@ -1959,7 +1959,7 @@
         'ODM/etc/build_pro.prop': '\n'.join(build_pro_prop),
     })
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       placeholder_values = {
           'ro.boot.product.device_name': 'std'
       }
@@ -1974,7 +1974,7 @@
       'ro.product.odm.name': 'product1',
     }, partition_props.build_props)
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       placeholder_values = {
           'ro.boot.product.device_name': 'pro'
       }
@@ -1995,7 +1995,7 @@
         'ODM/etc/build.prop': '\n'.join(build_prop),
     })
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       partition_props = common.PartitionBuildProps.FromInputFile(
           input_zip, 'odm')
 
@@ -2038,7 +2038,7 @@
         'ODM/etc/build_product2.prop': '\n'.join(product2_prop),
     })
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       placeholder_values = {
           'ro.boot.product.device_name': 'std',
           'ro.boot.product.product_name': 'product1',
@@ -2055,7 +2055,7 @@
         'ro.product.odm.name': 'product1'
     }, partition_props.build_props)
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       placeholder_values = {
           'ro.boot.product.device_name': 'pro',
           'ro.boot.product.product_name': 'product2',
@@ -2089,7 +2089,7 @@
         'ODM/etc/build_pro.prop': '\n'.join(build_pro_prop),
     })
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       placeholder_values = {
           'ro.boot.product.device_name': 'std',
       }
@@ -2126,7 +2126,7 @@
         'ODM/etc/build_product2.prop': '\n'.join(product2_prop),
     })
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip:
       placeholder_values = {
           'ro.boot.product.device_name': 'std',
           'ro.boot.product.product_name': 'product1',
diff --git a/tools/releasetools/test_ota_from_target_files.py b/tools/releasetools/test_ota_from_target_files.py
index 84cd4c8..f96bc7b 100644
--- a/tools/releasetools/test_ota_from_target_files.py
+++ b/tools/releasetools/test_ota_from_target_files.py
@@ -37,7 +37,7 @@
 def construct_target_files(secondary=False):
   """Returns a target-files.zip file for generating OTA packages."""
   target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
-  with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+  with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
     # META/update_engine_config.txt
     target_files_zip.writestr(
         'META/update_engine_config.txt',
@@ -417,7 +417,7 @@
         'super_google_dynamic_partitions_partition_list=system vendor product',
     ])
 
-    with zipfile.ZipFile(input_file, 'a') as append_zip:
+    with zipfile.ZipFile(input_file, 'a', allowZip64=True) as append_zip:
       common.ZipWriteStr(append_zip, 'META/misc_info.txt', misc_info)
       common.ZipWriteStr(append_zip, 'META/dynamic_partitions_info.txt',
                          dynamic_partitions_info)
@@ -472,7 +472,7 @@
     zip_file = PropertyFilesTest.construct_zip_package(entries)
     # Add a large entry of 1 GiB if requested.
     if large_entry:
-      with zipfile.ZipFile(zip_file, 'a') as zip_fp:
+      with zipfile.ZipFile(zip_file, 'a', allowZip64=True) as zip_fp:
         zip_fp.writestr(
             # Using 'zoo' so that the entry stays behind others after signing.
             'zoo',
@@ -514,7 +514,7 @@
         'optional-entry2',
     ]
     zip_file = PropertyFilesTest.construct_zip_package(entries)
-    with zipfile.ZipFile(zip_file, 'a') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'a', allowZip64=True) as zip_fp:
       zip_fp.writestr(
           # 'foo-entry1' will appear ahead of all other entries (in alphabetical
           # order) after the signing, which will in turn trigger the
@@ -558,7 +558,7 @@
     )
     zip_file = self.construct_zip_package(entries)
     property_files = TestPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       property_files_string = property_files.Compute(zip_fp)
 
     tokens = self._parse_property_files_string(property_files_string)
@@ -574,7 +574,7 @@
     )
     zip_file = self.construct_zip_package(entries)
     property_files = TestPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       property_files_string = property_files.Compute(zip_fp)
 
     tokens = self._parse_property_files_string(property_files_string)
@@ -587,7 +587,7 @@
     )
     zip_file = self.construct_zip_package(entries)
     property_files = TestPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       self.assertRaises(KeyError, property_files.Compute, zip_fp)
 
   @test_utils.SkipIfExternalToolsUnavailable()
@@ -600,7 +600,7 @@
     ]
     zip_file = self.construct_zip_package(entries)
     property_files = TestPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       raw_metadata = property_files.GetPropertyFilesString(
           zip_fp, reserve_space=False)
       streaming_metadata = property_files.Finalize(zip_fp, len(raw_metadata))
@@ -625,7 +625,7 @@
     )
     zip_file = self.construct_zip_package(entries)
     property_files = TestPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       # First get the raw metadata string (i.e. without padding space).
       raw_metadata = property_files.GetPropertyFilesString(
           zip_fp, reserve_space=False)
@@ -660,7 +660,7 @@
     )
     zip_file = self.construct_zip_package(entries)
     property_files = TestPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       # First get the raw metadata string (i.e. without padding space).
       raw_metadata = property_files.GetPropertyFilesString(
           zip_fp, reserve_space=False)
@@ -702,7 +702,7 @@
     )
     zip_file = self.construct_zip_package(entries)
     property_files = StreamingPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       property_files_string = property_files.Compute(zip_fp)
 
     tokens = self._parse_property_files_string(property_files_string)
@@ -720,7 +720,7 @@
     ]
     zip_file = self.construct_zip_package(entries)
     property_files = StreamingPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       raw_metadata = property_files.GetPropertyFilesString(
           zip_fp, reserve_space=False)
       streaming_metadata = property_files.Finalize(zip_fp, len(raw_metadata))
@@ -744,7 +744,7 @@
     )
     zip_file = self.construct_zip_package(entries)
     property_files = StreamingPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       # First get the raw metadata string (i.e. without padding space).
       raw_metadata = property_files.GetPropertyFilesString(
           zip_fp, reserve_space=False)
@@ -802,7 +802,7 @@
     payload.Sign(payload_signer)
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       payload.WriteToZip(output_zip)
 
     # Find out the payload metadata offset and size.
@@ -867,7 +867,7 @@
     payload.Sign(payload_signer)
 
     zip_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(zip_file, 'w') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'w', allowZip64=True) as zip_fp:
       # 'payload.bin',
       payload.WriteToZip(zip_fp)
 
@@ -889,7 +889,7 @@
   def test_Compute(self):
     zip_file = self.construct_zip_package_withValidPayload()
     property_files = AbOtaPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       property_files_string = property_files.Compute(zip_fp)
 
     tokens = self._parse_property_files_string(property_files_string)
@@ -903,7 +903,7 @@
   def test_Finalize(self):
     zip_file = self.construct_zip_package_withValidPayload(with_metadata=True)
     property_files = AbOtaPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       raw_metadata = property_files.GetPropertyFilesString(
           zip_fp, reserve_space=False)
       property_files_string = property_files.Finalize(
@@ -920,7 +920,7 @@
   def test_Verify(self):
     zip_file = self.construct_zip_package_withValidPayload(with_metadata=True)
     property_files = AbOtaPropertyFiles()
-    with zipfile.ZipFile(zip_file, 'r') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'r', allowZip64=True) as zip_fp:
       raw_metadata = property_files.GetPropertyFilesString(
           zip_fp, reserve_space=False)
 
@@ -1087,7 +1087,7 @@
     payload.Sign(PayloadSigner())
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       payload.WriteToZip(output_zip)
 
     import check_ota_package_signature
@@ -1101,7 +1101,7 @@
     payload.Sign(PayloadSigner())
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       payload.WriteToZip(output_zip)
 
     import check_ota_package_signature
@@ -1140,7 +1140,7 @@
     payload.Sign(PayloadSigner())
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       payload.WriteToZip(output_zip)
 
     with zipfile.ZipFile(output_file) as verify_zip:
@@ -1162,14 +1162,14 @@
     payload = self._create_payload_full()
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       self.assertRaises(AssertionError, payload.WriteToZip, output_zip)
 
     # Also test with incremental payload.
     payload = self._create_payload_incremental()
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       self.assertRaises(AssertionError, payload.WriteToZip, output_zip)
 
   @test_utils.SkipIfExternalToolsUnavailable()
@@ -1178,7 +1178,7 @@
     payload.Sign(PayloadSigner())
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       payload.WriteToZip(output_zip)
 
     with zipfile.ZipFile(output_file) as verify_zip:
diff --git a/tools/releasetools/test_sign_target_files_apks.py b/tools/releasetools/test_sign_target_files_apks.py
index 308172f..18e4858 100644
--- a/tools/releasetools/test_sign_target_files_apks.py
+++ b/tools/releasetools/test_sign_target_files_apks.py
@@ -164,15 +164,15 @@
         "veritykeyid=id:d24f2590e9abab5cff5f59da4c4f0366e3f43e94\n")
 
     input_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(input_file, 'w') as input_zip:
+    with zipfile.ZipFile(input_file, 'w', allowZip64=True) as input_zip:
       input_zip.writestr('BOOT/cmdline', BOOT_CMDLINE1)
 
     # Test with the first certificate.
     cert_file = os.path.join(self.testdata_dir, 'verity.x509.pem')
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(input_file, 'r') as input_zip, \
-         zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip, \
+         zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       ReplaceVerityKeyId(input_zip, output_zip, cert_file)
 
     with zipfile.ZipFile(output_file) as output_zip:
@@ -181,8 +181,8 @@
     # Test with the second certificate.
     cert_file = os.path.join(self.testdata_dir, 'testkey.x509.pem')
 
-    with zipfile.ZipFile(input_file, 'r') as input_zip, \
-         zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip, \
+         zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       ReplaceVerityKeyId(input_zip, output_zip, cert_file)
 
     with zipfile.ZipFile(output_file) as output_zip:
@@ -195,12 +195,12 @@
         "loop.max_part=7\n")
 
     input_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(input_file, 'w') as input_zip:
+    with zipfile.ZipFile(input_file, 'w', allowZip64=True) as input_zip:
       input_zip.writestr('BOOT/cmdline', BOOT_CMDLINE)
 
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(input_file, 'r') as input_zip, \
-         zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(input_file, 'r', allowZip64=True) as input_zip, \
+         zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       ReplaceVerityKeyId(input_zip, output_zip, None)
 
     with zipfile.ZipFile(output_file) as output_zip:
@@ -284,7 +284,7 @@
     ]
     entry_name = 'SYSTEM/etc/security/otacerts.zip'
     output_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(output_file, 'w') as output_zip:
+    with zipfile.ZipFile(output_file, 'w', allowZip64=True) as output_zip:
       WriteOtacerts(output_zip, entry_name, certs)
     with zipfile.ZipFile(output_file) as input_zip:
       self.assertIn(entry_name, input_zip.namelist())
@@ -294,7 +294,7 @@
 
   def test_CheckApkAndApexKeysAvailable(self):
     input_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(input_file, 'w') as input_zip:
+    with zipfile.ZipFile(input_file, 'w', allowZip64=True) as input_zip:
       input_zip.writestr('SYSTEM/app/App1.apk', "App1-content")
       input_zip.writestr('SYSTEM/app/App2.apk.gz', "App2-content")
 
@@ -318,7 +318,7 @@
 
   def test_CheckApkAndApexKeysAvailable_invalidApexKeys(self):
     input_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(input_file, 'w') as input_zip:
+    with zipfile.ZipFile(input_file, 'w', allowZip64=True) as input_zip:
       input_zip.writestr('SYSTEM/apex/Apex1.apex', "Apex1-content")
       input_zip.writestr('SYSTEM/apex/Apex2.apex', "Apex2-content")
 
@@ -466,10 +466,10 @@
 
   def test_ReadApexKeysInfo(self):
     target_files = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', self.APEX_KEYS_TXT)
 
-    with zipfile.ZipFile(target_files) as target_files_zip:
+    with zipfile.ZipFile(target_files, allowZip64=True) as target_files_zip:
       keys_info = ReadApexKeysInfo(target_files_zip)
 
     self.assertEqual({
@@ -491,10 +491,10 @@
         'container_private_key="build/make/target/product/security/testkey2.pk8" '
         'partition="system"')
     target_files = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
 
-    with zipfile.ZipFile(target_files) as target_files_zip:
+    with zipfile.ZipFile(target_files, allowZip64=True) as target_files_zip:
       self.assertRaises(ValueError, ReadApexKeysInfo, target_files_zip)
 
   def test_ReadApexKeysInfo_missingPayloadPrivateKey(self):
@@ -505,10 +505,10 @@
         'container_certificate="build/make/target/product/security/testkey.x509.pem" '
         'container_private_key="build/make/target/product/security/testkey.pk8"')
     target_files = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
 
-    with zipfile.ZipFile(target_files) as target_files_zip:
+    with zipfile.ZipFile(target_files, allowZip64=True) as target_files_zip:
       keys_info = ReadApexKeysInfo(target_files_zip)
 
     self.assertEqual({
@@ -528,10 +528,10 @@
         'container_certificate="build/make/target/product/security/testkey.x509.pem" '
         'container_private_key="build/make/target/product/security/testkey.pk8"')
     target_files = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
 
-    with zipfile.ZipFile(target_files) as target_files_zip:
+    with zipfile.ZipFile(target_files, allowZip64=True) as target_files_zip:
       keys_info = ReadApexKeysInfo(target_files_zip)
 
     self.assertEqual({
@@ -551,10 +551,10 @@
         'container_certificate="PRESIGNED" '
         'container_private_key="PRESIGNED"')
     target_files = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
 
-    with zipfile.ZipFile(target_files) as target_files_zip:
+    with zipfile.ZipFile(target_files, allowZip64=True) as target_files_zip:
       keys_info = ReadApexKeysInfo(target_files_zip)
 
     self.assertEqual({
@@ -574,10 +574,10 @@
         'container_certificate="PRESIGNED" '
         'container_private_key="PRESIGNED"')
     target_files = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+    with zipfile.ZipFile(target_files, 'w', allowZip64=True) as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
 
-    with zipfile.ZipFile(target_files) as target_files_zip:
+    with zipfile.ZipFile(target_files, allowZip64=True) as target_files_zip:
       keys_info = ReadApexKeysInfo(target_files_zip)
 
     self.assertEqual({
diff --git a/tools/releasetools/test_utils.py b/tools/releasetools/test_utils.py
index 7b7f22a..ccd97a9 100755
--- a/tools/releasetools/test_utils.py
+++ b/tools/releasetools/test_utils.py
@@ -199,7 +199,7 @@
   @staticmethod
   def construct_zip_package(entries):
     zip_file = common.MakeTempFile(suffix='.zip')
-    with zipfile.ZipFile(zip_file, 'w') as zip_fp:
+    with zipfile.ZipFile(zip_file, 'w', allowZip64=True) as zip_fp:
       for entry in entries:
         zip_fp.writestr(
             entry,
diff --git a/tools/releasetools/test_validate_target_files.py b/tools/releasetools/test_validate_target_files.py
index ca70ca8..e9896ae 100644
--- a/tools/releasetools/test_validate_target_files.py
+++ b/tools/releasetools/test_validate_target_files.py
@@ -272,7 +272,7 @@
     input_file = common.MakeTempFile()
     all_entries = ['SYSTEM/', 'SYSTEM/b', 'SYSTEM/a', 'IMAGES/',
                    'IMAGES/system.map', 'IMAGES/system.img']
-    with zipfile.ZipFile(input_file, 'w') as input_zip:
+    with zipfile.ZipFile(input_file, 'w', allowZip64=True) as input_zip:
       for name in all_entries:
         input_zip.write(os.path.join(input_tmp, name), arcname=name)
 
@@ -321,7 +321,7 @@
     input_file = common.MakeTempFile()
     all_entries = ['SYSTEM/', 'SYSTEM/abc', 'IMAGES/',
                    'IMAGES/system.map', 'IMAGES/system.img']
-    with zipfile.ZipFile(input_file, 'w') as input_zip:
+    with zipfile.ZipFile(input_file, 'w', allowZip64=True) as input_zip:
       for name in all_entries:
         input_zip.write(os.path.join(input_tmp, name), arcname=name)
 
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index 2e3aa74..d2178b2 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -487,7 +487,7 @@
   input_tmp = common.UnzipTemp(args.target_files)
 
   info_dict = common.LoadInfoDict(input_tmp)
-  with zipfile.ZipFile(args.target_files, 'r') as input_zip:
+  with zipfile.ZipFile(args.target_files, 'r', allowZip64=True) as input_zip:
     ValidateFileConsistency(input_zip, input_tmp, info_dict)
 
   CheckBuildPropDuplicity(input_tmp)