Merge "Remove unnecessary branch for BOARD_HAS_EXT4_RESERVED_BLOCKS."
diff --git a/Changes.md b/Changes.md
index 37bbad0..7519096 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,5 +1,32 @@
 # Build System Changes for Android.mk Writers
 
+## PATH Tools {#PATH_Tools}
+
+The build has started restricting the external host tools usable inside the
+build. This will help ensure that build results are reproducible across
+different machines, and catch mistakes before they become larger issues.
+
+To start with, this includes replacing the $PATH with our own directory of
+tools, mirroring that of the host PATH.  The only difference so far is the
+removal of the host GCC tools. Anything that is not explicitly in the
+configuration as allowed will continue functioning, but will generate a log
+message. This is expected to become more restrictive over time.
+
+The configuration is located in build/soong/ui/build/paths/config.go, and
+contains all the common tools in use in many builds. Anything not in that list
+will currently print a warning in the `$OUT_DIR/soong.log` file, including the
+command and arguments used, and the process tree in order to help locate the
+usage.
+
+In order to fix any issues brought up by these checks, the best way to fix them
+is to use tools checked into the tree -- either as prebuilts, or building them
+as host tools during the build.
+
+As a temporary measure, you can set `TEMPORARY_DISABLE_PATH_RESTRICTIONS=true`
+in your environment to temporarily turn off the error checks and allow any tool
+to be used (with logging). Beware that GCC didn't work well with the interposer
+used for logging, so this may not help in all cases.
+
 ## Deprecating / obsoleting envsetup.sh variables in Makefiles
 
 It is not required to source envsetup.sh before running a build. Many scripts,
diff --git a/CleanSpec.mk b/CleanSpec.mk
index 043aa60..beca20b 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -476,6 +476,9 @@
 $(call add-clean-step, rm -rf $(TARGET_COMMON_OUT_ROOT)/obj_asan/APPS/*_intermediates/java-source-list)
 $(call add-clean-step, rm -rf $(TARGET_COMMON_OUT_ROOT)/obj_asan/JAVA_LIBRARIES/*_intermediates/java-source-list)
 
+# Remove stale init.noenforce.rc
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/init/gsi/init.noenforce.rc)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/Makefile b/core/Makefile
index e9454f9..252bd22 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -125,8 +125,12 @@
   else
     FINAL_VENDOR_DEFAULT_PROPERTIES := ro.vndk.version=$(BOARD_VNDK_VERSION)
   endif
+  ifdef BOARD_VNDK_RUNTIME_DISABLE
+    FINAL_VENDOR_DEFAULT_PROPERTIES += ro.vndk.lite=true
+  endif
 else
-  FINAL_VENDOR_DEFAULT_PROPERTIES :=
+  FINAL_VENDOR_DEFAULT_PROPERTIES := ro.vndk.version=$(PLATFORM_VNDK_VERSION)
+  FINAL_VENDOR_DEFAULT_PROPERTIES += ro.vndk.lite=true
 endif
 FINAL_VENDOR_DEFAULT_PROPERTIES += \
     $(call collapse-pairs, $(PRODUCT_DEFAULT_PROPERTY_OVERRIDES))
@@ -1346,8 +1350,6 @@
   # Copying baseline ramdisk...
   # Use rsync because "cp -Rf" fails to overwrite broken symlinks on Mac.
   $(hide) rsync -a --exclude=etc --exclude=sdcard $(IGNORE_RECOVERY_SEPOLICY) $(IGNORE_CACHE_LINK) $(TARGET_ROOT_OUT) $(TARGET_RECOVERY_OUT)
-  # Copy adbd from system/bin to recovery/root/sbin
-  $(hide) cp -f $(TARGET_OUT_EXECUTABLES)/adbd $(TARGET_RECOVERY_ROOT_OUT)/sbin/adbd
   # Modifying ramdisk contents...
   $(if $(BOARD_RECOVERY_KERNEL_MODULES), \
     $(call build-image-kernel-modules,$(BOARD_RECOVERY_KERNEL_MODULES),$(TARGET_RECOVERY_ROOT_OUT),,$(call intermediates-dir-for,PACKAGING,depmod_recovery)))
@@ -1400,8 +1402,6 @@
       $(hide) $(AVBTOOL) add_hash_footer --image $(1) --partition_size $(BOARD_RECOVERYIMAGE_PARTITION_SIZE) --partition_name recovery $(INTERNAL_AVB_RECOVERY_SIGNING_ARGS) $(BOARD_AVB_RECOVERY_ADD_HASH_FOOTER_ARGS)))
 endef
 
-ADBD := $(TARGET_OUT_EXECUTABLES)/adbd
-
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
 ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER))
 $(INSTALLED_BOOTIMAGE_TARGET) : $(BOOT_SIGNER)
@@ -1412,7 +1412,7 @@
 ifeq (true,$(BOARD_AVB_ENABLE))
 $(INSTALLED_BOOTIMAGE_TARGET) : $(AVBTOOL) $(BOARD_AVB_BOOT_KEY_PATH)
 endif
-$(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) $(ADBD) \
+$(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
 		$(INSTALLED_RAMDISK_TARGET) \
 		$(INTERNAL_RECOVERYIMAGE_FILES) \
 		$(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \
@@ -1427,7 +1427,7 @@
 		$(call build-recoveryimage-target, $@)
 endif
 
-$(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) $(ADBD) \
+$(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
 		$(INSTALLED_RAMDISK_TARGET) \
 		$(INSTALLED_BOOTIMAGE_TARGET) \
 		$(INTERNAL_RECOVERYIMAGE_FILES) \
@@ -2447,9 +2447,8 @@
 
 OTATOOLS_DEPS := \
   system/extras/ext4_utils/mke2fs.conf \
-  external/avb/test/data/atx_metadata.bin \
-  external/avb/test/data/testkey_atx_psk.pem \
-  external/avb/test/data/testkey_rsa4096.pem \
+  $(sort $(shell find external/avb/test/data -type f -name "testkey_*.pem" -o \
+      -name "atx_metadata.bin")) \
   $(sort $(shell find system/update_engine/scripts -name "*.pyc" -prune -o -type f -print)) \
   $(sort $(shell find build/target/product/security -type f -name "*.x509.pem" -o -name "*.pk8" -o \
       -name verity_key)) \
diff --git a/core/aapt2.mk b/core/aapt2.mk
index b3a7c93..fbbf3dd 100644
--- a/core/aapt2.mk
+++ b/core/aapt2.mk
@@ -64,9 +64,11 @@
 $(my_res_resources_flat) $(my_overlay_resources_flat) $(my_resources_flata): \
   PRIVATE_AAPT2_CFLAGS := --pseudo-localize
 
-my_static_library_resources := $(foreach l, $(call reverse-list,$(LOCAL_STATIC_ANDROID_LIBRARIES)),\
+# TODO(b/78447299): Forbid LOCAL_STATIC_JAVA_AAR_LIBRARIES in aapt2 and remove
+# support for it.
+my_static_library_resources := $(foreach l, $(call reverse-list,$(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES)),\
   $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/package-res.apk)
-my_static_library_extra_packages := $(foreach l, $(call reverse-list,$(LOCAL_STATIC_ANDROID_LIBRARIES)),\
+my_static_library_extra_packages := $(foreach l, $(call reverse-list,$(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES)),\
   $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/extra_packages)
 my_shared_library_resources := $(foreach l, $(LOCAL_SHARED_ANDROID_LIBRARIES),\
   $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/package-res.apk)
diff --git a/core/autogen_test_config.mk b/core/autogen_test_config.mk
index d2eb7c3..20c582a 100644
--- a/core/autogen_test_config.mk
+++ b/core/autogen_test_config.mk
@@ -17,8 +17,7 @@
 # This build rule allows TradeFed test config file to be created based on
 # following inputs:
 #   is_native: If the test is a native test.
-#   LOCAL_MANIFEST_FILE: Name of the AndroidManifest file for the test. If it's
-#       not set, default value `AndroidManifest.xml` will be used.
+#   full_android_manifest: Name of the AndroidManifest file for the test.
 # Output:
 #   autogen_test_config_file: Path to the test config file generated.
 
@@ -36,25 +35,17 @@
 my_auto_generate_config := true
 else
 # Auto generating test config file for instrumentation test
-ifeq ($(strip $(LOCAL_MANIFEST_FILE)),)
-  LOCAL_MANIFEST_FILE := AndroidManifest.xml
-endif
-ifdef LOCAL_FULL_MANIFEST_FILE
-  my_android_manifest := $(LOCAL_FULL_MANIFEST_FILE)
-else
-  my_android_manifest := $(LOCAL_PATH)/$(LOCAL_MANIFEST_FILE)
-endif
-ifneq (,$(wildcard $(my_android_manifest)))
+ifneq (,$(full_android_manifest))
 $(autogen_test_config_file): PRIVATE_AUTOGEN_TEST_CONFIG_SCRIPT := $(AUTOGEN_TEST_CONFIG_SCRIPT)
-$(autogen_test_config_file): PRIVATE_TEST_CONFIG_ANDROID_MANIFEST := $(my_android_manifest)
+$(autogen_test_config_file): PRIVATE_TEST_CONFIG_ANDROID_MANIFEST := $(full_android_manifest)
 $(autogen_test_config_file): PRIVATE_EMPTY_TEST_CONFIG := $(EMPTY_TEST_CONFIG)
 $(autogen_test_config_file): PRIVATE_TEMPLATE := $(INSTRUMENTATION_TEST_CONFIG_TEMPLATE)
-$(autogen_test_config_file) : $(my_android_manifest) $(EMPTY_TEST_CONFIG) $(INSTRUMENTATION_TEST_CONFIG_TEMPLATE) $(AUTOGEN_TEST_CONFIG_SCRIPT)
+$(autogen_test_config_file) : $(full_android_manifest) $(EMPTY_TEST_CONFIG) $(INSTRUMENTATION_TEST_CONFIG_TEMPLATE) $(AUTOGEN_TEST_CONFIG_SCRIPT)
 	@echo "Auto generating test config $(notdir $@)"
 	@rm -f $@
 	$(hide) $(PRIVATE_AUTOGEN_TEST_CONFIG_SCRIPT) $@ $(PRIVATE_TEST_CONFIG_ANDROID_MANIFEST) $(PRIVATE_EMPTY_TEST_CONFIG) $(PRIVATE_TEMPLATE)
 my_auto_generate_config := true
-endif # ifeq (,$(wildcard $(my_android_manifest)))
+endif # ifneq (,$(full_android_manifest))
 endif # ifneq (true,$(is_native))
 
 ifeq (true,$(my_auto_generate_config))
@@ -65,5 +56,4 @@
   autogen_test_config_file :=
 endif
 
-my_android_manifest :=
 my_auto_generate_config :=
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 63c6c52..075465e 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -557,7 +557,8 @@
 # The module itself.
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
   $(eval my_compat_dist_$(suite) := $(foreach dir, $(call compatibility_suite_dirs,$(suite),$(arch_dir)), \
-    $(LOCAL_BUILT_MODULE):$(dir)/$(my_installed_module_stem))))
+    $(LOCAL_BUILT_MODULE):$(dir)/$(my_installed_module_stem))) \
+  $(eval my_compat_dist_config_$(suite) := ))
 
 # Make sure we only add the files once for multilib modules.
 ifndef $(my_prefix)$(LOCAL_MODULE_CLASS)_$(LOCAL_MODULE)_compat_files
@@ -604,7 +605,7 @@
 
 ifneq (,$(test_config))
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
-  $(eval my_compat_dist_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
+  $(eval my_compat_dist_config_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
     $(test_config):$(dir)/$(LOCAL_MODULE).config)))
 endif
 
@@ -612,14 +613,14 @@
 
 ifneq (,$(wildcard $(LOCAL_PATH)/DynamicConfig.xml))
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
-  $(eval my_compat_dist_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
+  $(eval my_compat_dist_config_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
     $(LOCAL_PATH)/DynamicConfig.xml:$(dir)/$(LOCAL_MODULE).dynamic)))
 endif
 
 ifneq (,$(wildcard $(LOCAL_PATH)/$(LOCAL_MODULE)_*.config))
 $(foreach extra_config, $(wildcard $(LOCAL_PATH)/$(LOCAL_MODULE)_*.config), \
   $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
-    $(eval my_compat_dist_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
+    $(eval my_compat_dist_config_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
       $(extra_config):$(dir)/$(notdir $(extra_config))))))
 endif
 endif # $(my_prefix)$(LOCAL_MODULE_CLASS)_$(LOCAL_MODULE)_compat_files
@@ -638,6 +639,8 @@
 is_native :=
 
 $(call create-suite-dependencies)
+$(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
+  $(eval my_compat_dist_config_$(suite) := ))
 
 endif  # LOCAL_COMPATIBILITY_SUITE
 
diff --git a/core/binary.mk b/core/binary.mk
index cb9c8a2..e3adaf3 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -804,7 +804,7 @@
 $(RenderScript_file_stamp): PRIVATE_RS_FLAGS := $(renderscript_flags)
 $(RenderScript_file_stamp): PRIVATE_RS_SOURCE_FILES := $(renderscript_sources_fullpath)
 $(RenderScript_file_stamp): PRIVATE_RS_OUTPUT_DIR := $(renderscript_intermediate)
-$(RenderScript_file_stamp): PRIVATE_RS_TARGET_API := $(filter-out current,$(renderscript_target_api))
+$(RenderScript_file_stamp): PRIVATE_RS_TARGET_API := $(patsubst current,0,$(renderscript_target_api))
 $(RenderScript_file_stamp): PRIVATE_DEP_FILES := $(bc_dep_files)
 $(RenderScript_file_stamp): $(renderscript_sources_fullpath) $(LOCAL_RENDERSCRIPT_CC)
 	$(transform-renderscripts-to-cpp-and-bc)
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 4224fda..1a33153 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -469,6 +469,8 @@
 LOCAL_CUSTOM_BUILD_STEP_OUTPUT:=
 LOCAL_IS_AUX_MODULE :=
 
+full_android_manifest :=
+
 # Trim MAKEFILE_LIST so that $(call my-dir) doesn't need to
 # iterate over thousands of entries every time.
 # Leave the current makefile to make sure we don't break anything
diff --git a/core/config.mk b/core/config.mk
index b94acd5..04dca0f 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -552,8 +552,9 @@
 prebuilt_build_tools := prebuilts/build-tools
 prebuilt_build_tools_wrappers := prebuilts/build-tools/common/bin
 prebuilt_build_tools_jars := prebuilts/build-tools/common/framework
+prebuilt_build_tools_bin_noasan := $(prebuilt_build_tools)/$(HOST_PREBUILT_TAG)/bin
 ifeq ($(filter address,$(SANITIZE_HOST)),)
-prebuilt_build_tools_bin := $(prebuilt_build_tools)/$(HOST_PREBUILT_TAG)/bin
+prebuilt_build_tools_bin := $(prebuilt_build_tools_bin_noasan)
 else
 prebuilt_build_tools_bin := $(prebuilt_build_tools)/$(HOST_PREBUILT_TAG)/asan/bin
 endif
@@ -623,13 +624,13 @@
 # ---------------------------------------------------------------
 # Generic tools.
 
-LEX := prebuilts/misc/$(BUILD_OS)-$(HOST_PREBUILT_ARCH)/flex/flex-2.5.39
+LEX := $(prebuilt_build_tools_bin_noasan)/flex
 # The default PKGDATADIR built in the prebuilt bison is a relative path
 # prebuilts/build-tools/common/bison.
 # To run bison from elsewhere you need to set up enviromental variable
 # BISON_PKGDATADIR.
 BISON_PKGDATADIR := $(PWD)/prebuilts/build-tools/common/bison
-BISON := prebuilts/build-tools/$(BUILD_OS)-$(HOST_PREBUILT_ARCH)/bin/bison
+BISON := $(prebuilt_build_tools_bin_noasan)/bison
 YACC := $(BISON) -d
 BISON_DATA := $(wildcard $(BISON_PKGDATADIR)/* $(BISON_PKGDATADIR)/*/*)
 
@@ -712,9 +713,12 @@
 
 # Tool to merge AndroidManifest.xmls
 ANDROID_MANIFEST_MERGER_CLASSPATH := \
-    prebuilts/gradle-plugin/com/android/tools/build/manifest-merger/26.0.0-beta2/manifest-merger-26.0.0-beta2.jar \
-    prebuilts/gradle-plugin/com/android/tools/sdk-common/26.0.0-beta2/sdk-common-26.0.0-beta2.jar \
-    prebuilts/gradle-plugin/com/android/tools/common/26.0.0-beta2/common-26.0.0-beta2.jar \
+    prebuilts/gradle-plugin/com/android/tools/build/manifest-merger/26.1.0/manifest-merger-26.1.0.jar \
+    prebuilts/gradle-plugin/com/android/tools/common/26.1.0/common-26.1.0.jar \
+    prebuilts/gradle-plugin/com/android/tools/sdk-common/26.1.0/sdk-common-26.1.0.jar \
+    prebuilts/gradle-plugin/com/android/tools/sdklib/26.1.0/sdklib-26.1.0.jar \
+    prebuilts/gradle-plugin/org/jetbrains/kotlin/kotlin-runtime/1.0.5/kotlin-runtime-1.0.5.jar \
+    prebuilts/gradle-plugin/org/jetbrains/kotlin/kotlin-stdlib/1.1.3/kotlin-stdlib-1.1.3.jar \
     prebuilts/misc/common/guava/guava-21.0.jar
 ANDROID_MANIFEST_MERGER := $(JAVA) \
     -classpath $(subst $(space),:,$(strip $(ANDROID_MANIFEST_MERGER_CLASSPATH))) \
@@ -913,6 +917,15 @@
     PLATFORM_SEPOLICY_VERSION \
     TOT_SEPOLICY_VERSION \
 
+ifndef USE_LOGICAL_PARTITIONS
+  USE_LOGICAL_PARTITIONS := $(PRODUCT_USE_LOGICAL_PARTITIONS)
+endif
+.KATI_READONLY := USE_LOGICAL_PARTITIONS
+
+ifeq ($(USE_LOGICAL_PARTITIONS),true)
+  BOARD_KERNEL_CMDLINE += androidboot.lrap=1
+endif
+
 # ###############################################################
 # Set up final options.
 # ###############################################################
diff --git a/core/definitions.mk b/core/definitions.mk
index a1a178b..e18f9a4 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -2150,11 +2150,13 @@
 define _create-default-manifest-file
 $(1):
 	rm -f $1
-	echo '<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="missing.manifest"></manifest>' > $1
+	(echo '<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="missing.manifest">' && \
+	 echo '    <uses-sdk android:minSdkVersion="$(2)" />' && \
+	 echo '</manifest>' ) > $1
 endef
 
 define create-default-manifest-file
-  $(eval $(call _create-default-manifest-file,$(1)))
+  $(eval $(call _create-default-manifest-file,$(1),$(2)))
 endef
 
 
@@ -2682,6 +2684,18 @@
 	$$(copy-file-to-target)
 endef
 
+# Copies many xml files and check they are well-formed.
+# $(1): The xml files to copy.  Each entry is a ':' separated src:dst pair.
+# Evaluates to the list of the dst files. (ie suitable for a dependency list.)
+define copy-many-xml-files-checked
+$(foreach f, $(1), $(strip \
+    $(eval _cmf_tuple := $(subst :, ,$(f))) \
+    $(eval _cmf_src := $(word 1,$(_cmf_tuple))) \
+    $(eval _cmf_dest := $(word 2,$(_cmf_tuple))) \
+    $(eval $(call copy-xml-file-checked,$(_cmf_src),$(_cmf_dest))) \
+    $(_cmf_dest)))
+endef
+
 # Copy the file only if it is a well-formed manifest file. For use viea $(eval)
 # $(1): source file
 # $(2): destination file
@@ -3127,15 +3141,20 @@
 
 # For each suite:
 # 1. Copy the files to the many suite output directories.
+#    And for test config files, we'll check the .xml is well-formed before copy.
 # 2. Add all the files to each suite's dependent files list.
 # 3. Do the dependency addition to my_all_targets
-# Requires for each suite: my_compat_dist_$(suite) to be defined.
+# Requires for each suite: use my_compat_dist_config_$(suite) to define the test config.
+#    and use my_compat_dist_$(suite) to define the others.
 define create-suite-dependencies
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
   $(eval COMPATIBILITY.$(suite).FILES := \
-    $$(COMPATIBILITY.$(suite).FILES) $$(foreach f,$$(my_compat_dist_$(suite)),$$(call word-colon,2,$$(f))))) \
+    $$(COMPATIBILITY.$(suite).FILES) $$(foreach f,$$(my_compat_dist_$(suite)),$$(call word-colon,2,$$(f))) \
+      $$(foreach f,$$(my_compat_dist_config_$(suite)),$$(call word-colon,2,$$(f))))) \
 $(eval $(my_all_targets) : $(call copy-many-files, \
-  $(sort $(foreach suite,$(LOCAL_COMPATIBILITY_SUITE),$(my_compat_dist_$(suite))))))
+  $(sort $(foreach suite,$(LOCAL_COMPATIBILITY_SUITE),$(my_compat_dist_$(suite))))) \
+  $(call copy-many-xml-files-checked, \
+    $(sort $(foreach suite,$(LOCAL_COMPATIBILITY_SUITE),$(my_compat_dist_config_$(suite))))))
 endef
 
 ###########################################################
diff --git a/core/dex_preopt_libart.mk b/core/dex_preopt_libart.mk
index 3b9e4e1..64ad200 100644
--- a/core/dex_preopt_libart.mk
+++ b/core/dex_preopt_libart.mk
@@ -165,7 +165,7 @@
 # $(2): the output .odex file
 # In the case where LOCAL_ENFORCE_USES_LIBRARIES is true, PRIVATE_DEX2OAT_CLASS_LOADER_CONTEXT
 # contains the normalized path list of the libraries. This makes it easier to conditionally prepend
-# org.apache.http.legacy.boot based on the SDK level if required.
+# org.apache.http.legacy.impl based on the SDK level if required.
 define dex2oat-one-file
 $(hide) rm -f $(2)
 $(hide) mkdir -p $(dir $(2))
diff --git a/core/envsetup.mk b/core/envsetup.mk
index 1a36703..dc4bc3b 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -671,7 +671,7 @@
 
 TARGET_OUT_PRODUCT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_PRODUCT)
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
-target_out_product_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/system
+target_out_product_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/product
 ifeq ($(SANITIZE_LITE),true)
 # When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
 # work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
@@ -680,7 +680,7 @@
 target_out_product_app_base := $(TARGET_OUT_PRODUCT)
 endif
 else
-target_out_product_shared_libraries_base := $(TARGET_OUT)
+target_out_product_shared_libraries_base := $(TARGET_OUT_PRODUCT)
 target_out_product_app_base := $(TARGET_OUT_PRODUCT)
 endif
 
diff --git a/core/force_aapt2.mk b/core/force_aapt2.mk
index 41bf710..ede6fd4 100644
--- a/core/force_aapt2.mk
+++ b/core/force_aapt2.mk
@@ -17,25 +17,26 @@
 # Including this makefile will force AAPT2 on if FORCE_AAPT2==true,
 # rewriting some properties to convert standard AAPT usage to AAPT2.
 
-ifeq ($(FORCE_AAPT2),true)
+ifneq ($(FORCE_AAPT2),false)
   ifeq ($(LOCAL_USE_AAPT2),)
     # Force AAPT2 on
     LOCAL_USE_AAPT2 := true
-    # Move LOCAL_STATIC_JAVA_AAR_LIBRARIES to LOCAL_STATIC_ANDROID_LIBRARIES
-    LOCAL_STATIC_ANDROID_LIBRARIES := $(strip $(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES))
-    LOCAL_STATIC_JAVA_AAR_LIBRARIES :=
     # Filter out support library resources
     LOCAL_RESOURCE_DIR := $(filter-out \
       prebuilts/sdk/current/% \
       frameworks/support/%,\
         $(LOCAL_RESOURCE_DIR))
     # Filter out unnecessary aapt flags
-    LOCAL_AAPT_FLAGS := $(subst --extra-packages=,--extra-packages$(space), \
-      $(filter-out \
-        --extra-packages=android.support.% \
-        --extra-packages=androidx.% \
-        --auto-add-overlay,\
-          $(subst --extra-packages$(space),--extra-packages=,$(LOCAL_AAPT_FLAGS))))
+    ifneq (,$(filter --extra-packages,$(LOCAL_AAPT_FLAGS)))
+      LOCAL_AAPT_FLAGS := $(subst --extra-packages=,--extra-packages$(space), \
+        $(filter-out \
+          --extra-packages=android.support.% \
+          --extra-packages=androidx.%, \
+            $(subst --extra-packages$(space),--extra-packages=,$(LOCAL_AAPT_FLAGS))))
+        ifeq (,$(filter --extra-packages,$(LOCAL_AAPT_FLAGS)))
+          LOCAL_AAPT_FLAGS := $(filter-out --auto-add-overlay,$(LOCAL_AAPT_FLAGS))
+        endif
+    endif
 
     # AAPT2 is pickier about missing resources.  Support library may have references to resources
     # added in current, so always treat LOCAL_SDK_VERSION as LOCAL_SDK_RES_VERSION := current.
@@ -46,9 +47,16 @@
     ifeq (,$(strip $(LOCAL_MANIFEST_FILE)$(LOCAL_FULL_MANIFEST_FILE)))
       ifeq (,$(wildcard $(LOCAL_PATH)/AndroidManifest.xml))
         # work around missing manifests by creating a default one
-        $(call pretty-warning, Missing manifest file)
         LOCAL_FULL_MANIFEST_FILE := $(call local-intermediates-dir,COMMON)/DefaultManifest.xml
-        $(call create-default-manifest-file,$(LOCAL_FULL_MANIFEST_FILE))
+        ifdef LOCAL_MIN_SDK_VERSION
+          my_manifest_min_sdk_version := $(LOCAL_MIN_SDK_VERSION)
+        else ifneq (,$(filter-out current system_current test_current core_current, $(LOCAL_SDK_VERSION)))
+          my_manifest_min_sdk_version := $(call get-numeric-sdk-version,$(LOCAL_SDK_VERSION))
+        else
+          my_manifest_min_sdk_version := $(DEFAULT_APP_TARGET_SDK)
+        endif
+        $(call create-default-manifest-file,$(LOCAL_FULL_MANIFEST_FILE),$(my_manifest_min_sdk_version))
+        my_manifest_min_sdk_version :=
       endif
     endif
   endif
diff --git a/core/java.mk b/core/java.mk
index 8e5fd1d..c6b4ffb 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -458,6 +458,9 @@
 ifeq ($(filter obfuscation,$(LOCAL_PROGUARD_ENABLED)),)
 # By default no obfuscation
 common_proguard_flags += -dontobfuscate
+# Workaround for b/80081393: R8 discards other attributes when
+# -keepattributes *Annotations* is used, even when obfuscation is off.
+common_proguard_flags += -keepattributes '*'
 endif  # No obfuscation
 ifeq ($(filter optimization,$(LOCAL_PROGUARD_ENABLED)),)
 # By default no optimization
diff --git a/core/java_common.mk b/core/java_common.mk
index b75949a..f4696d7 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -263,9 +263,8 @@
     ifneq (,$(TARGET_BUILD_APPS))
       sdk_libs := $(foreach lib_name,$(LOCAL_SDK_LIBRARIES),$(call resolve-prebuilt-sdk-module,system_current,$(lib_name)))
     else
-      # When SDK libraries are referenced from modules built without SDK, provide the system stub to them
-      # because it has the largest API surface.
-      sdk_libs := $(foreach lib_name,$(LOCAL_SDK_LIBRARIES),$(lib_name).stubs.system)
+      # When SDK libraries are referenced from modules built without SDK, provide the all APIs to them
+      sdk_libs := $(foreach lib_name,$(LOCAL_SDK_LIBRARIES),$(lib_name).impl)
     endif
   else
     ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
diff --git a/core/java_renderscript.mk b/core/java_renderscript.mk
index 2d3af0b..d7dd4ed 100644
--- a/core/java_renderscript.mk
+++ b/core/java_renderscript.mk
@@ -75,7 +75,7 @@
 $(rs_generated_src_jar): PRIVATE_RS_FLAGS := $(renderscript_flags)
 $(rs_generated_src_jar): PRIVATE_RS_SOURCE_FILES := $(renderscript_sources_fullpath)
 $(rs_generated_src_jar): PRIVATE_RS_OUTPUT_DIR := $(renderscript_intermediate.COMMON)
-$(rs_generated_src_jar): PRIVATE_RS_TARGET_API := $(filter-out current,$(renderscript_target_api))
+$(rs_generated_src_jar): PRIVATE_RS_TARGET_API := $(patsubst current,0,$(renderscript_target_api))
 $(rs_generated_src_jar): PRIVATE_DEP_FILES := $(bc_dep_files)
 $(rs_generated_src_jar): PRIVATE_RS_OUTPUT_RES_ZIP := $(rs_generated_res_zip)
 $(rs_generated_src_jar): .KATI_IMPLICIT_OUTPUTS := $(rs_generated_res_zip)
diff --git a/core/main.mk b/core/main.mk
index 2ef17a2..c1059d7 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -229,6 +229,8 @@
 ADDITIONAL_DEFAULT_PROPERTIES += ro.actionable_compatible_property.enabled=${PRODUCT_COMPATIBLE_PROPERTY}
 endif
 
+ADDITIONAL_BUILD_PROPERTIES += ro.boot.logical_partitions=${USE_LOGICAL_PARTITIONS}
+
 # -----------------------------------------------------------------
 ###
 ### In this section we set up the things that are different
diff --git a/core/package_internal.mk b/core/package_internal.mk
index 64e9fe1..637a135 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -89,6 +89,9 @@
 
 include $(BUILD_SYSTEM)/force_aapt2.mk
 
+# Process Support Library dependencies.
+include $(BUILD_SYSTEM)/support_libraries.mk
+
 package_resource_overlays := $(strip \
     $(wildcard $(foreach dir, $(PRODUCT_PACKAGE_OVERLAYS), \
       $(addprefix $(dir)/, $(LOCAL_RESOURCE_DIR)))) \
@@ -161,7 +164,7 @@
 my_res_dir :=
 my_overlay_res_dirs :=
 
-ifneq ($(LOCAL_STATIC_ANDROID_LIBRARIES),)
+ifneq ($(strip $(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES)),)
 # If we are using static android libraries, every source file becomes an overlay.
 # This is to emulate old AAPT behavior which simulated library support.
 my_res_dir :=
@@ -316,9 +319,6 @@
 LOCAL_AAPT_FLAGS += --auto-add-overlay --extra-packages com.android.databinding.library
 endif  # LOCAL_DATA_BINDING
 
-# Process Support Library dependencies.
-include $(BUILD_SYSTEM)/support_libraries.mk
-
 # If the module is a compressed module, we don't pre-opt it because its final
 # installation location will be the data partition.
 ifdef LOCAL_COMPRESSED_MODULE
diff --git a/core/product.mk b/core/product.mk
index 976c939..95d169c 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -197,6 +197,7 @@
     PRODUCT_CFI_EXCLUDE_PATHS \
     PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE \
     PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE \
+    PRODUCT_USE_LOGICAL_PARTITIONS \
 
 define dump-product
 $(info ==== $(1) ====)\
diff --git a/core/product_config.mk b/core/product_config.mk
index 6449b9f..3a77d0b 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -500,3 +500,8 @@
 # Whether the whitelist of actionable compatible properties should be disabled or not
 PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE))
+
+# Logical and Resizable Partitions feature flag.
+PRODUCT_USE_LOGICAL_PARTITIONS := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_USE_LOGICAL_PARTITIONS))
+.KATI_READONLY := PRODUCT_USE_LOGICAL_PARTITIONS
diff --git a/core/setup_one_odex.mk b/core/setup_one_odex.mk
index 5cc6085..92f58b2 100644
--- a/core/setup_one_odex.mk
+++ b/core/setup_one_odex.mk
@@ -70,7 +70,7 @@
 
   # Calculate system build dependencies based on the filtered libraries.
   my_intermediate_libs := $(foreach lib_name, $(my_lib_names) $(my_filtered_optional_uses_libraries), \
-    $(call intermediates-dir-for,JAVA_LIBRARIES,$(lib_name),,)/javalib.jar)
+    $(call intermediates-dir-for,JAVA_LIBRARIES,$(lib_name),,COMMON)/javalib.jar)
   my_dex_preopt_system_dependencies := $(my_intermediate_libs)
   my_dex_preopt_class_loader_context := $(call normalize-path-list,$(my_intermediate_libs))
 
@@ -78,21 +78,17 @@
   my_stored_preopt_class_loader_context_libs := $(call normalize-path-list, \
       $(foreach lib_name,$(my_filtered_uses_libraries),/system/framework/$(lib_name).jar))
 
-  # Fix up org.apache.http.legacy.boot since it should be org.apache.http.legacy in the manifest.
-  my_lib_names := $(patsubst org.apache.http.legacy.boot,org.apache.http.legacy,$(my_lib_names))
-  my_optional_lib_names := $(patsubst org.apache.http.legacy.boot,org.apache.http.legacy,$(my_optional_lib_names))
+  # Fix up org.apache.http.legacy.impl since it should be org.apache.http.legacy in the manifest.
+  my_lib_names := $(patsubst org.apache.http.legacy.impl,org.apache.http.legacy,$(my_lib_names))
+  my_optional_lib_names := $(patsubst org.apache.http.legacy.impl,org.apache.http.legacy,$(my_optional_lib_names))
   ifeq (,$(filter org.apache.http.legacy,$(my_lib_names) $(my_optional_lib_names)))
-    my_conditional_uses_libraries_host := $(call intermediates-dir-for,JAVA_LIBRARIES,org.apache.http.legacy.boot,,)/javalib.jar
-    my_conditional_uses_libraries_target := /system/framework/org.apache.http.legacy.boot.jar
+    my_conditional_uses_libraries_host := $(call intermediates-dir-for,JAVA_LIBRARIES,org.apache.http.legacy.impl,,COMMON)/javalib.jar
+    my_conditional_uses_libraries_target := /system/framework/org.apache.http.legacy.impl.jar
   endif
 endif
 
-# Always depend on org.apache.http.legacy.boot since it may get used by dex2oat-one-file for apps
-# targetting <SDK 28(P).
-my_always_depend_libraries := $(call intermediates-dir-for,JAVA_LIBRARIES,org.apache.http.legacy.boot,,COMMON)/javalib.jar
-
 $(my_built_odex): $(AAPT)
-$(my_built_odex): $(my_always_depend_libraries)
+$(my_built_odex): $(my_conditional_uses_libraries_host)
 $(my_built_odex): $(my_dex_preopt_system_dependencies)
 $(my_built_odex): PRIVATE_ENFORCE_USES_LIBRARIES := $(LOCAL_ENFORCE_USES_LIBRARIES)
 $(my_built_odex): PRIVATE_CONDITIONAL_USES_LIBRARIES_HOST := $(my_conditional_uses_libraries_host)
diff --git a/core/soong_config.mk b/core/soong_config.mk
index ea3714a..3f1fb66 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -143,8 +143,8 @@
 
 $(call add_json_list, BoardVendorSepolicyDirs,           $(BOARD_SEPOLICY_DIRS))
 $(call add_json_list, BoardOdmSepolicyDirs,              $(BOARD_ODM_SEPOLICY_DIRS))
-$(call add_json_str,  BoardPlatPublicSepolicyDir,        $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
-$(call add_json_str,  BoardPlatPrivateSepolicyDir,       $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
+$(call add_json_list, BoardPlatPublicSepolicyDirs,       $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
+$(call add_json_list, BoardPlatPrivateSepolicyDirs,      $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
 
 _contents := $(_contents)    "VendorVars": {$(newline)
 $(foreach namespace,$(SOONG_CONFIG_NAMESPACES),\
diff --git a/core/static_java_library.mk b/core/static_java_library.mk
index 2cd29f1..2a87705 100644
--- a/core/static_java_library.mk
+++ b/core/static_java_library.mk
@@ -28,15 +28,15 @@
 
 my_res_package :=
 
+# Process Support Library dependencies.
+include $(BUILD_SYSTEM)/support_libraries.mk
+
 include $(BUILD_SYSTEM)/force_aapt2.mk
 
 ifdef LOCAL_AAPT2_ONLY
 LOCAL_USE_AAPT2 := true
 endif
 
-# Process Support Library dependencies.
-include $(BUILD_SYSTEM)/support_libraries.mk
-
 # Hack to build static Java library with Android resource
 # See bug 5714516
 all_resources :=
@@ -47,7 +47,7 @@
 LOCAL_RESOURCE_DIR := $(foreach d,$(LOCAL_RESOURCE_DIR),$(call clean-path,$(d)))
 endif
 ifeq ($(LOCAL_USE_AAPT2),true)
-ifneq ($(LOCAL_STATIC_ANDROID_LIBRARIES),)
+ifneq ($(strip $(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES)),)
 need_compile_res := true
 endif
 endif
@@ -120,7 +120,7 @@
 endif
 
 ifeq ($(LOCAL_USE_AAPT2),true)
-import_proguard_flag_files := $(strip $(foreach l,$(LOCAL_STATIC_ANDROID_LIBRARIES),\
+import_proguard_flag_files := $(strip $(foreach l,$(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES),\
     $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/export_proguard_flags))
 $(intermediates.COMMON)/export_proguard_flags: $(import_proguard_flag_files) $(addprefix $(LOCAL_PATH)/,$(LOCAL_EXPORT_PROGUARD_FLAG_FILES))
 	@echo "Export proguard flags: $@"
diff --git a/target/product/base.mk b/target/product/base.mk
index d6507c6..74514af 100644
--- a/target/product/base.mk
+++ b/target/product/base.mk
@@ -18,7 +18,7 @@
 PRODUCT_PACKAGES += \
     20-dns.conf \
     95-configured \
-    org.apache.http.legacy.boot \
+    org.apache.http.legacy \
     appwidget \
     appops \
     am \
diff --git a/target/product/core.mk b/target/product/core.mk
index bbc2b75..90e15db 100644
--- a/target/product/core.mk
+++ b/target/product/core.mk
@@ -46,7 +46,6 @@
     ManagedProvisioning \
     MtpDocumentsProvider \
     PacProcessor \
-    libpac \
     PrintSpooler \
     PrintRecommendationService \
     ProxyHandler \
diff --git a/target/product/core_minimal.mk b/target/product/core_minimal.mk
index 16599cb..8797248 100644
--- a/target/product/core_minimal.mk
+++ b/target/product/core_minimal.mk
@@ -116,7 +116,7 @@
     telephony-common \
     voip-common \
     ims-common \
-    org.apache.http.legacy.boot \
+    org.apache.http.legacy.impl \
     android.hidl.base-V1.0-java \
     android.hidl.manager-V1.0-java
 
diff --git a/target/product/core_tiny.mk b/target/product/core_tiny.mk
index 122f5c7..c6bc72c 100644
--- a/target/product/core_tiny.mk
+++ b/target/product/core_tiny.mk
@@ -103,7 +103,7 @@
     voip-common \
     ims-common \
     nullwebview \
-    org.apache.http.legacy.boot \
+    org.apache.http.legacy.impl \
     android.hidl.base-V1.0-java \
     android.hidl.manager-V1.0-java
 
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 6ddc07e..bae5486 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -20,6 +20,7 @@
 PRODUCT_PACKAGES += \
     adb \
     adbd \
+    adbd.recovery \
     usbd \
     android.hardware.configstore@1.0-service \
     android.hidl.allocator@1.0-service \
diff --git a/target/product/treble_common.mk b/target/product/treble_common.mk
index 5352e77..7e0e2ae 100644
--- a/target/product/treble_common.mk
+++ b/target/product/treble_common.mk
@@ -76,15 +76,11 @@
 PRODUCT_COPY_FILES += \
     device/generic/common/nfc/libnfc-nci.conf:system/etc/libnfc-nci.conf
 
-# Support for the devices with no VNDK enforcing
+# Support for the O-MR1 devices
 PRODUCT_COPY_FILES += \
     build/make/target/product/vndk/init.gsi.rc:system/etc/init/init.gsi.rc \
-    build/make/target/product/vndk/init.noenforce.rc:system/etc/init/gsi/init.noenforce.rc
+    build/make/target/product/vndk/init.vndk-27.rc:system/etc/init/gsi/init.vndk-27.rc
 
 # Name space configuration file for non-enforcing VNDK
 PRODUCT_PACKAGES += \
-    ld.config.noenforce.txt
-
-# Set current VNDK version for GSI
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
-    ro.gsi.vndk.version=$(PLATFORM_VNDK_VERSION)
+    ld.config.vndk_lite.txt
diff --git a/target/product/vndk/init.gsi.rc b/target/product/vndk/init.gsi.rc
index 3e6b1fb..0150b1a 100644
--- a/target/product/vndk/init.gsi.rc
+++ b/target/product/vndk/init.gsi.rc
@@ -1,2 +1,2 @@
-# If ro.vndk.version is not defined, import init.noenforce.rc
-import /system/etc/init/gsi/init.${ro.vndk.version:-noenforce}.rc
+# If ro.vndk.version is not defined, import init.vndk-27.rc.
+import /system/etc/init/gsi/init.vndk-${ro.vndk.version:-27}.rc
diff --git a/target/product/vndk/init.noenforce.rc b/target/product/vndk/init.noenforce.rc
deleted file mode 100644
index 6cf1df7..0000000
--- a/target/product/vndk/init.noenforce.rc
+++ /dev/null
@@ -1,5 +0,0 @@
-on early-init
-    # If ro.vndk.version is not set, use ld.config.nonenforce.txt
-    export LD_CONFIG_FILE /system/etc/ld.config.noenforce.txt
-    # To use current VNDK libs, set ro.vndk.version to system vndk version
-    setprop ro.vndk.version ${ro.gsi.vndk.version}
diff --git a/target/product/vndk/init.vndk-27.rc b/target/product/vndk/init.vndk-27.rc
new file mode 100644
index 0000000..d464a2f
--- /dev/null
+++ b/target/product/vndk/init.vndk-27.rc
@@ -0,0 +1,3 @@
+on early-init
+    # Set ro.vndk.version to 27 so that O-MR1-VENDOR can run latest GSI.
+    setprop ro.vndk.version 27
diff --git a/tools/checkowners.py b/tools/checkowners.py
index 1190d30..54198a7 100755
--- a/tools/checkowners.py
+++ b/tools/checkowners.py
@@ -30,12 +30,11 @@
 
 def find_address(address):
   if address not in checked_addresses:
-    request = (gerrit_server + '/accounts/?n=1&o=ALL_EMAILS&q=email:'
+    request = (gerrit_server + '/accounts/?n=1&q=email:'
                + urllib.quote(address))
     echo('Checking email address: ' + address)
     result = urllib2.urlopen(request).read()
-    checked_addresses[address] = (
-        result.find('"email":') >= 0 and result.find('"_account_id":') >= 0)
+    checked_addresses[address] = result.find('"_account_id":') >= 0
   return checked_addresses[address]
 
 
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index acd5b6e..886de26 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -90,6 +90,12 @@
         logging.warning('Skipping %s that has incomplete block list', entry)
         continue
 
+      # TODO(b/79951650): Handle files with non-monotonic ranges.
+      if not ranges.monotonic:
+        logging.warning(
+            'Skipping %s that has non-monotonic ranges: %s', entry, ranges)
+        continue
+
       blocks_sha1 = image.RangeSha1(ranges)
 
       # The filename under unpacked directory, such as SYSTEM/bin/sh.