diff --git a/core/binary.mk b/core/binary.mk
index d8fda78..6a58c6c 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -290,6 +290,15 @@
 # Move other ldlibs back to shared libraries
 my_shared_libraries += $(patsubst -l%,lib%,$(filter-out $(my_allowed_ldlibs),$(my_ldlibs)))
 my_ldlibs := $(filter $(my_allowed_ldlibs),$(my_ldlibs))
+else # LOCAL_IS_HOST_MODULE
+  # Add -ldl, -lpthread and -lrt to host builds to match the default behavior of
+  # device builds
+  ifneq ($($(my_prefix)OS),windows)
+    my_ldlibs += -ldl -lpthread
+    ifneq ($(HOST_OS),darwin)
+      my_ldlibs += -lrt
+    endif
+  endif
 endif
 
 ifneq ($(LOCAL_SDK_VERSION),)
diff --git a/core/envsetup.mk b/core/envsetup.mk
index d8be9c3..db6ddd4 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -315,29 +315,17 @@
 
 SOONG_OUT_DIR := $(OUT_DIR)/soong
 
-DEBUG_OUT_DIR := $(OUT_DIR)/debug
+TARGET_OUT_ROOT := $(OUT_DIR)/target
 
-# Move the host or target under the debug/ directory
-# if necessary.
-TARGET_OUT_ROOT_release := $(OUT_DIR)/target
-TARGET_OUT_ROOT_debug := $(DEBUG_OUT_DIR)/target
-TARGET_OUT_ROOT := $(TARGET_OUT_ROOT_$(TARGET_BUILD_TYPE))
-
-HOST_OUT_ROOT_release := $(OUT_DIR)/host
-HOST_OUT_ROOT_debug := $(DEBUG_OUT_DIR)/host
-HOST_OUT_ROOT := $(HOST_OUT_ROOT_$(HOST_BUILD_TYPE))
+HOST_OUT_ROOT := $(OUT_DIR)/host
 
 # We want to avoid two host bin directories in multilib build.
-HOST_OUT_release := $(HOST_OUT_ROOT_release)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
-HOST_OUT_debug := $(HOST_OUT_ROOT_debug)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
-HOST_OUT := $(HOST_OUT_$(HOST_BUILD_TYPE))
+HOST_OUT := $(HOST_OUT_ROOT)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
 SOONG_HOST_OUT := $(SOONG_OUT_DIR)/host/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
 # TODO: remove
 BUILD_OUT := $(HOST_OUT)
 
-HOST_CROSS_OUT_release := $(HOST_OUT_ROOT_release)/windows-$(HOST_PREBUILT_ARCH)
-HOST_CROSS_OUT_debug := $(HOST_OUT_ROOT_debug)/windows-$(HOST_PREBUILT_ARCH)
-HOST_CROSS_OUT := $(HOST_CROSS_OUT_$(HOST_BUILD_TYPE))
+HOST_CROSS_OUT := $(HOST_OUT_ROOT)/windows-$(HOST_PREBUILT_ARCH)
 
 TARGET_PRODUCT_OUT_ROOT := $(TARGET_OUT_ROOT)/product
 
diff --git a/core/package_internal.mk b/core/package_internal.mk
index a626dde..11138db 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -122,7 +122,18 @@
   endif
 endif
 
-ifndef enforce_rro_enabled
+ifdef enforce_rro_enabled
+  ifneq ($(PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS),)
+    static_only_resource_overlays := $(filter $(addsuffix %,$(PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS)),$(package_resource_overlays))
+    ifneq ($(static_only_resource_overlays),)
+      package_resource_overlays := $(filter-out $(static_only_resource_overlays),$(package_resource_overlays))
+      LOCAL_RESOURCE_DIR := $(static_only_resource_overlays) $(LOCAL_RESOURCE_DIR)
+      ifeq ($(package_resource_overlays),)
+        enforce_rro_enabled :=
+      endif
+    endif
+  endif
+else
 LOCAL_RESOURCE_DIR := $(package_resource_overlays) $(LOCAL_RESOURCE_DIR)
 endif
 
diff --git a/core/pdk_config.mk b/core/pdk_config.mk
index 8c986d6..bef183e 100644
--- a/core/pdk_config.mk
+++ b/core/pdk_config.mk
@@ -99,9 +99,6 @@
 ifeq (true,$(TARGET_BUILD_PDK_JAVA_PLATFORM))
 
 PDK_FUSION_OUT_DIR := $(OUT_DIR)
-ifeq (debug,$(TARGET_BUILD_TYPE))
-PDK_FUSION_OUT_DIR := $(DEBUG_OUT_DIR)
-endif
 
 define JAVA_dependency_template
 $(call add-dependency,$(PDK_FUSION_OUT_DIR)/$(strip $(1)),\
diff --git a/core/product.mk b/core/product.mk
index 1a0e8c6..95e3b27 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -94,6 +94,7 @@
     PRODUCT_EXTRA_RECOVERY_KEYS \
     PRODUCT_PACKAGE_OVERLAYS \
     DEVICE_PACKAGE_OVERLAYS \
+    PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS \
     PRODUCT_ENFORCE_RRO_TARGETS \
     PRODUCT_SDK_ATREE_FILES \
     PRODUCT_SDK_ADDON_NAME \
diff --git a/core/product_config.mk b/core/product_config.mk
index 4194e00..6ab40c0 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -434,6 +434,10 @@
 PRODUCT_IOT := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_IOT))
 
+# Resource overlay list which must be excluded from enforcing RRO.
+PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS))
+
 # Package list to apply enforcing RRO.
 PRODUCT_ENFORCE_RRO_TARGETS := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_RRO_TARGETS))
diff --git a/core/soong_java_prebuilt.mk b/core/soong_java_prebuilt.mk
new file mode 100644
index 0000000..ee8b199
--- /dev/null
+++ b/core/soong_java_prebuilt.mk
@@ -0,0 +1,45 @@
+# Java prebuilt coming from Soong.
+# Extra inputs:
+# LOCAL_SOONG_HEADER_JAR
+# LOCAL_SOONG_DEX
+
+ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+  $(call pretty-error,soong_java_prebuilt.mk may only be used from Soong)
+endif
+
+# TODO: device support
+ifndef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,exporting soong device jars to make not supported yet)
+endif
+
+LOCAL_MODULE_SUFFIX := .jar
+LOCAL_BUILT_MODULE_STEM := javalib.jar
+
+#######################################
+include $(BUILD_SYSTEM)/base_rules.mk
+#######################################
+
+full_classes_jar := $(intermediates.COMMON)/classes.jar
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
+
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_PREBUILT_MODULE_FILE)
+
+#######################################
+include $(BUILD_SYSTEM)/jacoco.mk
+#######################################
+
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(LOCAL_BUILT_MODULE)))
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_jar)))
+
+ifdef LOCAL_SOONG_HEADER_JAR
+$(eval $(call copy-one-file,$(LOCAL_SOONG_HEADER_JAR),$(full_classes_header_jar)))
+else
+$(eval $(call copy-one-file,$(full_classes_jar),$(full_classes_header_jar)))
+endif
+
+javac-check : $(full_classes_jar)
+javac-check-$(LOCAL_MODULE) : $(full_classes_jar)
+
+# Built in equivalent to include $(CLEAR_VARS)
+LOCAL_SOONG_HEADER_JAR :=
+LOCAL_SOONG_DEX :=
diff --git a/tools/atree/Android.bp b/tools/atree/Android.bp
new file mode 100644
index 0000000..3c3a8ef
--- /dev/null
+++ b/tools/atree/Android.bp
@@ -0,0 +1,13 @@
+// Copyright 2007 The Android Open Source Project
+//
+// Copies files into the directory structure described by a manifest
+
+cc_binary_host {
+    name: "atree",
+    srcs: [
+        "atree.cpp",
+        "files.cpp",
+        "fs.cpp",
+    ],
+    static_libs: ["libhost"],
+}
diff --git a/tools/atree/Android.mk b/tools/atree/Android.mk
deleted file mode 100644
index f598db5..0000000
--- a/tools/atree/Android.mk
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2007 The Android Open Source Project
-#
-# Copies files into the directory structure described by a manifest
-
-LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := \
-	atree.cpp \
-	files.cpp \
-	fs.cpp
-
-LOCAL_STATIC_LIBRARIES := \
-	libhost
-
-LOCAL_MODULE := atree
-
-include $(BUILD_HOST_EXECUTABLE)
-
diff --git a/tools/checkowners.py b/tools/checkowners.py
index b874955..1190d30 100755
--- a/tools/checkowners.py
+++ b/tools/checkowners.py
@@ -34,8 +34,8 @@
                + urllib.quote(address))
     echo('Checking email address: ' + address)
     result = urllib2.urlopen(request).read()
-    expected = '"email": "' + address + '"'
-    checked_addresses[address] = (result.find(expected) >= 0)
+    checked_addresses[address] = (
+        result.find('"email":') >= 0 and result.find('"_account_id":') >= 0)
   return checked_addresses[address]
 
 
diff --git a/tools/fs_config/Android.bp b/tools/fs_config/Android.bp
new file mode 100644
index 0000000..797cfe2
--- /dev/null
+++ b/tools/fs_config/Android.bp
@@ -0,0 +1,63 @@
+// Copyright (C) 2008 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_binary_host {
+    name: "fs_config",
+    srcs: ["fs_config.c"],
+    shared_libs: [
+        "libcutils",
+        "libselinux",
+    ],
+    cflags: ["-Werror"],
+}
+
+// -----------------------------------------------------------------------------
+// Unit tests.
+// -----------------------------------------------------------------------------
+
+test_c_flags = [
+    "-fstack-protector-all",
+    "-g",
+    "-Wall",
+    "-Wextra",
+    "-Werror",
+    "-fno-builtin",
+    "-DANDROID_FILESYSTEM_CONFIG=\"android_filesystem_config_test_data.h\"",
+]
+
+//#################################
+// test executable
+cc_test_host {
+    name: "fs_config_generate_test",
+    srcs: ["fs_config_generate.c"],
+    shared_libs: ["libcutils"],
+    cflags: test_c_flags,
+    relative_install_path: "fs_config-unit-tests",
+    no_named_install_directory: true,
+    gtest: false,
+
+}
+
+//#################################
+// gTest tool
+cc_test_host {
+    name: "fs_config-unit-tests",
+    cflags: test_c_flags + ["-DHOST"],
+    shared_libs: [
+        "liblog",
+        "libcutils",
+        "libbase",
+    ],
+    srcs: ["fs_config_test.cpp"],
+}
diff --git a/tools/fs_config/Android.mk b/tools/fs_config/Android.mk
index ab7f92d..3773d38 100644
--- a/tools/fs_config/Android.mk
+++ b/tools/fs_config/Android.mk
@@ -14,15 +14,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := fs_config.c
-LOCAL_MODULE := fs_config
-LOCAL_SHARED_LIBRARIES := libcutils libselinux
-LOCAL_CFLAGS := -Werror
-
-include $(BUILD_HOST_EXECUTABLE)
-
 # One can override the default android_filesystem_config.h file in one of two ways:
 #
 # 1. The old way:
@@ -306,36 +297,3 @@
 fs_config_generate_bin :=
 my_gen_oem_aid :=
 fs_config_generate_extra_partition_list :=
-
-# -----------------------------------------------------------------------------
-# Unit tests.
-# -----------------------------------------------------------------------------
-
-test_c_flags := \
-    -fstack-protector-all \
-    -g \
-    -Wall \
-    -Wextra \
-    -Werror \
-    -fno-builtin \
-    -DANDROID_FILESYSTEM_CONFIG='"android_filesystem_config_test_data.h"'
-
-##################################
-# test executable
-include $(CLEAR_VARS)
-LOCAL_MODULE := fs_config_generate_test
-LOCAL_SRC_FILES := fs_config_generate.c
-LOCAL_SHARED_LIBRARIES := libcutils
-LOCAL_CFLAGS := $(test_c_flags)
-LOCAL_MODULE_RELATIVE_PATH := fs_config-unit-tests
-LOCAL_GTEST := false
-include $(BUILD_HOST_NATIVE_TEST)
-
-##################################
-# gTest tool
-include $(CLEAR_VARS)
-LOCAL_MODULE := fs_config-unit-tests
-LOCAL_CFLAGS += $(test_c_flags) -DHOST
-LOCAL_SHARED_LIBRARIES := liblog libcutils libbase
-LOCAL_SRC_FILES := fs_config_test.cpp
-include $(BUILD_HOST_NATIVE_TEST)
diff --git a/tools/fs_get_stats/Android.bp b/tools/fs_get_stats/Android.bp
new file mode 100644
index 0000000..6684319
--- /dev/null
+++ b/tools/fs_get_stats/Android.bp
@@ -0,0 +1,8 @@
+cc_binary_host {
+    name: "fs_get_stats",
+    srcs: ["fs_get_stats.c"],
+    shared_libs: [
+        "libcutils",
+        "liblog",
+    ],
+}
diff --git a/tools/fs_get_stats/Android.mk b/tools/fs_get_stats/Android.mk
deleted file mode 100644
index 4501c1f..0000000
--- a/tools/fs_get_stats/Android.mk
+++ /dev/null
@@ -1,11 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := fs_get_stats.c
-
-LOCAL_MODULE := fs_get_stats
-
-LOCAL_SHARED_LIBRARIES := libcutils liblog
-
-include $(BUILD_HOST_EXECUTABLE)
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index 6de9763..d2c9f59 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -36,30 +36,36 @@
 FIXED_SALT = "aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7"
 BLOCK_SIZE = 4096
 
-def RunCommand(cmd):
+def RunCommand(cmd, verbose=None):
   """Echo and run the given command.
 
   Args:
     cmd: the command represented as a list of strings.
+    verbose: show commands being executed.
   Returns:
     A tuple of the output and the exit code.
   """
-  print "Running: ", " ".join(cmd)
+  if verbose is None:
+    verbose = OPTIONS.verbose
+  if verbose:
+    print("Running: " + " ".join(cmd))
   p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
   output, _ = p.communicate()
-  print "%s" % (output.rstrip(),)
+
+  if verbose:
+    print(output.rstrip())
   return (output, p.returncode)
 
 def GetVerityFECSize(partition_size):
   cmd = ["fec", "-s", str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
 
 def GetVerityTreeSize(partition_size):
   cmd = ["build_verity_tree", "-s", str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
@@ -67,7 +73,7 @@
 def GetVerityMetadataSize(partition_size):
   cmd = ["system/extras/verity/build_verity_metadata.py", "size",
          str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
@@ -186,6 +192,8 @@
     else:
       hi = i
 
+  print("Adjusted partition size for verity, partition_size: {},"
+        " verity_size: {}".format(result, verity_size))
   AdjustPartitionSizeForVerity.results[key] = (result, verity_size)
   return (result, verity_size)
 
@@ -513,9 +521,9 @@
 
   try:
     if fs_type.startswith("ext4"):
-      (ext4fs_output, exit_code) = RunCommand(build_command)
+      (ext4fs_output, exit_code) = RunCommand(build_command, True)
     else:
-      (_, exit_code) = RunCommand(build_command)
+      (_, exit_code) = RunCommand(build_command, True)
   finally:
     if in_dir != origin_in:
       # Clean up temporary directories and files.
diff --git a/tools/releasetools/check_ota_package_signature.py b/tools/releasetools/check_ota_package_signature.py
index 548b619..1f8b7bb 100755
--- a/tools/releasetools/check_ota_package_signature.py
+++ b/tools/releasetools/check_ota_package_signature.py
@@ -25,12 +25,19 @@
 import re
 import subprocess
 import sys
+import tempfile
+import zipfile
 
 from hashlib import sha1
 from hashlib import sha256
 
+# 'update_payload' package is under 'system/update_engine/scripts/', which
+# should to be included in PYTHONPATH.
+from update_payload.payload import Payload
+from update_payload.update_metadata_pb2 import Signatures
 
-def cert_uses_sha256(cert):
+
+def CertUsesSha256(cert):
   """Check if the cert uses SHA-256 hashing algorithm."""
 
   cmd = ['openssl', 'x509', '-text', '-noout', '-in', cert]
@@ -46,7 +53,7 @@
   return algorithm.group(1).startswith('sha256')
 
 
-def verify_package(cert, package):
+def VerifyPackage(cert, package):
   """Verify the given package with the certificate.
 
   (Comments from bootable/recovery/verifier.cpp:)
@@ -90,7 +97,7 @@
   print('Signed data length: %d' % (signed_len,))
   print('Signature start: %d' % (signature_start,))
 
-  use_sha256 = cert_uses_sha256(cert)
+  use_sha256 = CertUsesSha256(cert)
   print('Use SHA-256: %s' % (use_sha256,))
 
   if use_sha256:
@@ -100,7 +107,7 @@
   h.update(package_bytes[:signed_len])
   package_digest = h.hexdigest().lower()
 
-  print('Digest: %s\n' % (package_digest,))
+  print('Digest: %s' % (package_digest,))
 
   # Get the signature from the input package.
   signature = package_bytes[signature_start:-6]
@@ -141,7 +148,87 @@
   assert package_digest == digest_string, "Verification failed."
 
   # Verified successfully upon reaching here.
-  print('VERIFIED\n')
+  print('\nWhole package signature VERIFIED\n')
+
+
+def VerifyAbOtaPayload(cert, package):
+  """Verifies the payload and metadata signatures in an A/B OTA payload."""
+
+  def VerifySignatureBlob(hash_file, blob):
+    """Verifies the input hash_file against the signature blob."""
+    signatures = Signatures()
+    signatures.ParseFromString(blob)
+
+    extracted_sig_file = common.MakeTempFile(
+        prefix='extracted-sig-', suffix='.bin')
+    # In Android, we only expect one signature.
+    assert len(signatures.signatures) == 1, \
+        'Invalid number of signatures: %d' % len(signatures.signatures)
+    signature = signatures.signatures[0]
+    length = len(signature.data)
+    assert length == 256, 'Invalid signature length %d' % (length,)
+    with open(extracted_sig_file, 'w') as f:
+      f.write(signature.data)
+
+    # Verify the signature file extracted from the payload, by reversing the
+    # signing operation. Alternatively, this can be done by calling 'openssl
+    # rsautl -verify -certin -inkey <cert.pem> -in <extracted_sig_file> -out
+    # <output>', then to assert that
+    # <output> == SHA-256 DigestInfo prefix || <hash_file>.
+    cmd = ['openssl', 'pkeyutl', '-verify', '-certin', '-inkey', cert,
+           '-pkeyopt', 'digest:sha256', '-in', hash_file,
+           '-sigfile', extracted_sig_file]
+    p = common.Run(cmd, stdout=subprocess.PIPE)
+    result, _ = p.communicate()
+
+    # https://github.com/openssl/openssl/pull/3213
+    # 'openssl pkeyutl -verify' (prior to 1.1.0) returns non-zero return code,
+    # even on successful verification. To avoid the false alarm with older
+    # openssl, check the output directly.
+    assert result.strip() == 'Signature Verified Successfully', result.strip()
+
+  package_zip = zipfile.ZipFile(package, 'r')
+  if 'payload.bin' not in package_zip.namelist():
+    common.ZipClose(package_zip)
+    return
+
+  print('Verifying A/B OTA payload signatures...')
+
+  package_dir = tempfile.mkdtemp(prefix='package-')
+  common.OPTIONS.tempfiles.append(package_dir)
+
+  payload_file = package_zip.extract('payload.bin', package_dir)
+  payload = Payload(open(payload_file, 'rb'))
+  payload.Init()
+
+  # Extract the payload hash and metadata hash from the payload.bin.
+  payload_hash_file = common.MakeTempFile(prefix='hash-', suffix='.bin')
+  metadata_hash_file = common.MakeTempFile(prefix='hash-', suffix='.bin')
+  cmd = ['brillo_update_payload', 'hash',
+         '--unsigned_payload', payload_file,
+         '--signature_size', '256',
+         '--metadata_hash_file', metadata_hash_file,
+         '--payload_hash_file', payload_hash_file]
+  p = common.Run(cmd, stdout=subprocess.PIPE)
+  p.communicate()
+  assert p.returncode == 0, 'brillo_update_payload hash failed'
+
+  # Payload signature verification.
+  assert payload.manifest.HasField('signatures_offset')
+  payload_signature = payload.ReadDataBlob(
+      payload.manifest.signatures_offset, payload.manifest.signatures_size)
+  VerifySignatureBlob(payload_hash_file, payload_signature)
+
+  # Metadata signature verification.
+  metadata_signature = payload.ReadDataBlob(
+      -payload.header.metadata_signature_len,
+      payload.header.metadata_signature_len)
+  VerifySignatureBlob(metadata_hash_file, metadata_signature)
+
+  common.ZipClose(package_zip)
+
+  # Verified successfully upon reaching here.
+  print('\nPayload signatures VERIFIED\n\n')
 
 
 def main():
@@ -150,7 +237,8 @@
   parser.add_argument('package', help='The OTA package to be verified.')
   args = parser.parse_args()
 
-  verify_package(args.certificate, args.package)
+  VerifyPackage(args.certificate, args.package)
+  VerifyAbOtaPayload(args.certificate, args.package)
 
 
 if __name__ == '__main__':
@@ -159,3 +247,5 @@
   except AssertionError as err:
     print('\n    ERROR: %s\n' % (err,))
     sys.exit(1)
+  finally:
+    common.Cleanup()
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index 8ac3322..4b34820 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -44,8 +44,8 @@
   return sparse_img.SparseImage(path, mappath, clobbered_blocks)
 
 
-def _CalculateFileSha1(file_name, unpacked_name, round_up=False):
-  """Calculate the SHA-1 for a given file. Round up its size to 4K if needed."""
+def _ReadFile(file_name, unpacked_name, round_up=False):
+  """Constructs and returns a File object. Rounds up its size if needed."""
 
   def RoundUpTo4K(value):
     rounded_up = value + 4095
@@ -58,7 +58,7 @@
   if round_up:
     file_size_rounded_up = RoundUpTo4K(file_size)
     file_data += '\0' * (file_size_rounded_up - file_size)
-  return common.File(file_name, file_data).sha1
+  return common.File(file_name, file_data)
 
 
 def ValidateFileAgainstSha1(input_tmp, file_name, file_path, expected_sha1):
@@ -67,7 +67,7 @@
   logging.info('Validating the SHA-1 of {}'.format(file_name))
   unpacked_name = os.path.join(input_tmp, file_path)
   assert os.path.exists(unpacked_name)
-  actual_sha1 = _CalculateFileSha1(file_name, unpacked_name, False)
+  actual_sha1 = _ReadFile(file_name, unpacked_name, False).sha1
   assert actual_sha1 == expected_sha1, \
       'SHA-1 mismatches for {}. actual {}, expected {}'.format(
       file_name, actual_sha1, expected_sha1)
@@ -92,8 +92,20 @@
       # The filename under unpacked directory, such as SYSTEM/bin/sh.
       unpacked_name = os.path.join(
           input_tmp, which.upper(), entry[(len(prefix) + 1):])
-      file_sha1 = _CalculateFileSha1(entry, unpacked_name, True)
+      unpacked_file = _ReadFile(entry, unpacked_name, True)
+      file_size = unpacked_file.size
 
+      # block.map may contain less blocks, because mke2fs may skip allocating
+      # blocks if they contain all zeros. We can't reconstruct such a file from
+      # its block list. (Bug: 65213616)
+      if file_size > ranges.size() * 4096:
+        logging.warning(
+            'Skipping %s that has less blocks: file size %d-byte,'
+            ' ranges %s (%d-byte)', entry, file_size, ranges,
+            ranges.size() * 4096)
+        continue
+
+      file_sha1 = unpacked_file.sha1
       assert blocks_sha1 == file_sha1, \
           'file: %s, range: %s, blocks_sha1: %s, file_sha1: %s' % (
               entry, ranges, blocks_sha1, file_sha1)
diff --git a/tools/zipalign/Android.bp b/tools/zipalign/Android.bp
new file mode 100644
index 0000000..cfc6aec
--- /dev/null
+++ b/tools/zipalign/Android.bp
@@ -0,0 +1,31 @@
+//
+// Copyright 2008 The Android Open Source Project
+//
+// Zip alignment tool
+//
+
+cc_binary_host {
+    name: "zipalign",
+
+    srcs: [
+        "ZipAlign.cpp",
+        "ZipEntry.cpp",
+        "ZipFile.cpp",
+    ],
+
+    static_libs: [
+        "libandroidfw",
+        "libutils",
+        "libcutils",
+        "liblog",
+        "libzopfli",
+        "libz",
+    ],
+
+    target: {
+        windows: {
+            host_ldlibs: ["-lpthread"],
+            enabled: true,
+        },
+    },
+}
diff --git a/tools/zipalign/Android.mk b/tools/zipalign/Android.mk
deleted file mode 100644
index 8c0240a..0000000
--- a/tools/zipalign/Android.mk
+++ /dev/null
@@ -1,38 +0,0 @@
-# 
-# Copyright 2008 The Android Open Source Project
-#
-# Zip alignment tool
-#
-
-LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := \
-	ZipAlign.cpp \
-	ZipEntry.cpp \
-	ZipFile.cpp
-
-LOCAL_C_INCLUDES += external/zlib \
-	external/zopfli/src
-
-LOCAL_STATIC_LIBRARIES := \
-	libandroidfw \
-	libutils \
-	libcutils \
-	liblog \
-	libzopfli
-
-LOCAL_LDLIBS_linux += -lrt
-
-LOCAL_STATIC_LIBRARIES_windows += libz
-LOCAL_LDLIBS_linux += -lz
-LOCAL_LDLIBS_darwin += -lz
-
-ifneq ($(strip $(BUILD_HOST_static)),)
-LOCAL_LDLIBS += -lpthread
-endif # BUILD_HOST_static
-
-LOCAL_MODULE := zipalign
-LOCAL_MODULE_HOST_OS := darwin linux windows
-
-include $(BUILD_HOST_EXECUTABLE)