diff --git a/core/Makefile b/core/Makefile
index 9c0804e..cf062a2 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -4777,6 +4777,7 @@
 	$(target_notice_file_txt) \
 	$(tools_notice_file_txt) \
 	$(OUT_DOCS)/offline-sdk-timestamp \
+	$(SDK_METADATA_FILES) \
 	$(SYMBOLS_ZIP) \
 	$(COVERAGE_ZIP) \
 	$(APPCOMPAT_ZIP) \
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index d67c9f8..b4452e1 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -73,6 +73,7 @@
 LOCAL_DROIDDOC_DOC_ZIP :=
 LOCAL_DROIDDOC_JDIFF_DOC_ZIP :=
 LOCAL_DROIDDOC_HTML_DIR:=
+LOCAL_DROIDDOC_METADATA_ZIP:=
 LOCAL_DROIDDOC_OPTIONS:=
 LOCAL_DROIDDOC_SOURCE_PATH:=
 LOCAL_DROIDDOC_STUB_OUT_DIR:=
diff --git a/core/soong_droiddoc_prebuilt.mk b/core/soong_droiddoc_prebuilt.mk
index bf1f10b..c0467df 100644
--- a/core/soong_droiddoc_prebuilt.mk
+++ b/core/soong_droiddoc_prebuilt.mk
@@ -38,3 +38,7 @@
 .PHONY: $(LOCAL_MODULE) $(LOCAL_MODULE)-jdiff
 $(LOCAL_MODULE) $(LOCAL_MODULE)-jdiff : $(OUT_DOCS)/$(LOCAL_MODULE)-jdiff-docs.zip
 endif
+
+ifdef LOCAL_DROIDDOC_METADATA_ZIP
+$(eval $(call copy-one-file,$(LOCAL_DROIDDOC_METADATA_ZIP),$(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/$(LOCAL_MODULE)-metadata.zip))
+endif
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 892a07d..7e96214 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -250,7 +250,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2019-12-05
+      PLATFORM_SECURITY_PATCH := 2020-02-05
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
diff --git a/target/product/developer_gsi_keys.mk b/target/product/developer_gsi_keys.mk
new file mode 100644
index 0000000..79451ad
--- /dev/null
+++ b/target/product/developer_gsi_keys.mk
@@ -0,0 +1,29 @@
+#
+# Copyright (C) 2019 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Device makers who are willing to support booting the public Developer-GSI
+# in locked state can add the following line into a device.mk to inherit this
+# makefile. This file will then install the up-to-date GSI public keys into
+# the first-stage ramdisk to pass verified boot.
+#
+# In device/<company>/<board>/device.mk:
+#   $(call inherit-product, $(SRC_TARGET_DIR)/product/developer_gsi_keys.mk)
+#
+# Currently, the developer GSI images can be downloaded from the following URL:
+#   https://developer.android.com/topic/generic-system-image/releases
+#
+PRODUCT_PACKAGES += \
+    q-developer-gsi.avbpubkey \