Merge changes I5e887932,I648960b3

* changes:
  re-enable b run commands in test suite
  re-enable b test suite
diff --git a/Changes.md b/Changes.md
index 27e52f2..3ad2641 100644
--- a/Changes.md
+++ b/Changes.md
@@ -827,6 +827,27 @@
 ```
 
 `BUILD_BROKEN_CLANG_PROPERTY` can be used as temporarily workaround
+
+
+### Stop using clang_cflags and clang_asflags
+
+clang_cflags and clang_asflags are deprecated.
+To fix any build errors, use bpmodify to either
+    - move the contents of clang_asflags/clang_cflags into asflags/cflags or
+    - delete clang_cflags/as_flags as necessary
+
+To Move the contents:
+``` make
+go run bpmodify.go -w -m=module_name -move-property=true -property=clang_cflags -new-location=cflags filepath
+```
+
+To Delete:
+``` make
+go run bpmodify.go -w -m=module_name -remove-property=true -property=clang_cflags filepath
+```
+
+`BUILD_BROKEN_CLANG_ASFLAGS` and `BUILD_BROKEN_CLANG_CFLAGS` can be used as temporarily workarounds
+
 ### Other envsetup.sh variables  {#other_envsetup_variables}
 
 * ANDROID_TOOLCHAIN
diff --git a/OWNERS b/OWNERS
index 6e7c0ea..8a1cc34 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,3 +1,4 @@
 include platform/build/soong:/OWNERS
 
-per-file finalize_branch_for_release.sh = smoreland@google.com
+# Finalization scripts
+per-file finalize* = smoreland@google.com, alexbuy@google.com
diff --git a/core/Makefile b/core/Makefile
index fe083f8..a802a4c 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -602,13 +602,7 @@
 	$(if $(filter true,$(PRODUCT_FSVERITY_GENERATE_METADATA)),\
 	  $(call _apkcerts_write_line,BuildManifest,$(FSVERITY_APK_KEY_PATH).x509.pem,$(FSVERITY_APK_KEY_PATH).pk8,,system,$@) \
 	  $(if $(filter true,$(BUILDING_SYSTEM_EXT_IMAGE)),\
-            $(call _apkcerts_write_line,BuildManifestSystemExt,$(FSVERITY_APK_KEY_PATH).x509.pem,$(FSVERITY_APK_KEY_PATH).pk8,,system_ext,$@)) \
-	  $(if $(filter true,$(BUILDING_VENDOR_IMAGE)),\
-            $(call _apkcerts_write_line,BuildManifestVendor,$(FSVERITY_APK_KEY_PATH).x509.pem,$(FSVERITY_APK_KEY_PATH).pk8,,vendor,$@)) \
-	  $(if $(filter true,$(BUILDING_ODM_IMAGE)),\
-            $(call _apkcerts_write_line,BuildManifestOdm,$(FSVERITY_APK_KEY_PATH).x509.pem,$(FSVERITY_APK_KEY_PATH).pk8,,odm,$@)) \
-	  $(if $(filter true,$(BUILDING_PRODUCT_IMAGE)),\
-            $(call _apkcerts_write_line,BuildManifestProduct,$(FSVERITY_APK_KEY_PATH).x509.pem,$(FSVERITY_APK_KEY_PATH).pk8,,product,$@)))
+            $(call _apkcerts_write_line,BuildManifestSystemExt,$(FSVERITY_APK_KEY_PATH).x509.pem,$(FSVERITY_APK_KEY_PATH).pk8,,system_ext,$@)))
 	# In case value of PACKAGES is empty.
 	$(hide) touch $@
 
@@ -2957,15 +2951,6 @@
 ifdef BUILDING_SYSTEM_EXT_IMAGE
 fsverity-metadata-targets-patterns += $(TARGET_OUT_SYSTEM_EXT)/framework/%
 endif
-ifdef BUILDING_VENDOR_IMAGE
-fsverity-metadata-targets-patterns += $(TARGET_OUT_VENDOR)/framework/%
-endif
-ifdef BUILDING_ODM_IMAGE
-fsverity-metadata-targets-patterns += $(TARGET_OUT_ODM)/framework/%
-endif
-ifdef BUILDING_PRODUCT_IMAGE
-fsverity-metadata-targets-patterns += $(TARGET_OUT_PRODUCT)/framework/%
-endif
 
 # Generate fsv_meta
 fsverity-metadata-targets := $(sort $(filter \
@@ -3039,18 +3024,6 @@
   $(eval $(call fsverity-generate-and-install-manifest-apk, \
     $(TARGET_OUT_SYSTEM_EXT)/etc/security/fsverity/BuildManifestSystemExt.apk,system_ext))
 endif
-ifdef BUILDING_VENDOR_IMAGE
-  $(eval $(call fsverity-generate-and-install-manifest-apk, \
-    $(TARGET_OUT_VENDOR)/etc/security/fsverity/BuildManifestVendor.apk,vendor))
-endif
-ifdef BUILDING_ODM_IMAGE
-  $(eval $(call fsverity-generate-and-install-manifest-apk, \
-    $(TARGET_OUT_ODM)/etc/security/fsverity/BuildManifestOdm.apk,odm))
-endif
-ifdef BUILDING_PRODUCT_IMAGE
-  $(eval $(call fsverity-generate-and-install-manifest-apk, \
-    $(TARGET_OUT_PRODUCT)/etc/security/fsverity/BuildManifestProduct.apk,product))
-endif
 
 endif  # PRODUCT_FSVERITY_GENERATE_METADATA
 
@@ -5092,8 +5065,8 @@
 endif
 
 INTERNAL_OTATOOLS_RELEASETOOLS := \
-  $(sort $(shell find build/make/tools/releasetools -name "*.pyc" -prune -o \
-      \( -type f -o -type l \) -print))
+  $(shell find build/make/tools/releasetools -name "*.pyc" -prune -o \
+      \( -type f -o -type l \) -print | sort)
 
 BUILT_OTATOOLS_PACKAGE := $(PRODUCT_OUT)/otatools.zip
 $(BUILT_OTATOOLS_PACKAGE): PRIVATE_ZIP_ROOT := $(call intermediates-dir-for,PACKAGING,otatools)/otatools
diff --git a/core/board_config.mk b/core/board_config.mk
index 0fda480..88516fa 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -175,6 +175,8 @@
 
 _build_broken_var_list := \
   BUILD_BROKEN_CLANG_PROPERTY \
+  BUILD_BROKEN_CLANG_ASFLAGS \
+  BUILD_BROKEN_CLANG_CFLAGS \
   BUILD_BROKEN_DEPFILE \
   BUILD_BROKEN_DUP_RULES \
   BUILD_BROKEN_DUP_SYSPROP \
diff --git a/core/cleanspec.mk b/core/cleanspec.mk
index af28954..0232a17 100644
--- a/core/cleanspec.mk
+++ b/core/cleanspec.mk
@@ -58,6 +58,12 @@
 #$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/JAVA_LIBRARIES/core_intermediates)
 #$(call add-clean-step, find $(OUT_DIR) -type f -name "IGTalkSession*" -print0 | xargs -0 rm -f)
 #$(call add-clean-step, rm -rf $(PRODUCT_OUT)/data/*)
+$(call add-clean-step, rm -rf $(OUT_DIR)/obj/ETC/build_manifest-vendor_intermediates)
+$(call add-clean-step, rm -rf $(OUT_DIR)/obj/ETC/build_manifest-odm_intermediates)
+$(call add-clean-step, rm -rf $(OUT_DIR)/obj/ETC/build_manifest-product_intermediates)
+$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/security/fsverity)
+$(call add-clean-step, rm -rf $(TARGET_OUT_ODM)/etc/security/fsverity)
+$(call add-clean-step, rm -rf $(TARGET_OUT_PRODUCT)/etc/security/fsverity)
 
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
diff --git a/core/soong_config.mk b/core/soong_config.mk
index 2ff064a..b000df6 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -275,7 +275,9 @@
 
 $(call add_json_str,  ShippingApiLevel, $(PRODUCT_SHIPPING_API_LEVEL))
 
-$(call add_json_bool, BuildBrokenClangProperty,                 $(filter true,$(BUILD_BROKEN_CLANG_PROPERTY)))
+$(call add_json_bool, BuildBrokenClangProperty,           $(filter true,$(BUILD_BROKEN_CLANG_PROPERTY)))
+$(call add_json_bool, BuildBrokenClangAsFlags,            $(filter true,$(BUILD_BROKEN_CLANG_ASFLAGS)))
+$(call add_json_bool, BuildBrokenClangCFlags,             $(filter true,$(BUILD_BROKEN_CLANG_CFLAGS)))
 $(call add_json_bool, BuildBrokenDepfile,                 $(filter true,$(BUILD_BROKEN_DEPFILE)))
 $(call add_json_bool, BuildBrokenEnforceSyspropOwner,     $(filter true,$(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER)))
 $(call add_json_bool, BuildBrokenTrebleSyspropNeverallow, $(filter true,$(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW)))
diff --git a/core/tasks/general-tests.mk b/core/tasks/general-tests.mk
index 5252394..5726ee2 100644
--- a/core/tasks/general-tests.mk
+++ b/core/tasks/general-tests.mk
@@ -42,16 +42,24 @@
 
 # Copy kernel test modules to testcases directories
 include $(BUILD_SYSTEM)/tasks/tools/vts-kernel-tests.mk
-kernel_test_copy_pairs := \
-  $(call target-native-copy-pairs,$(kernel_test_modules),$(kernel_test_host_out))
-copy_kernel_tests := $(call copy-many-files,$(kernel_test_copy_pairs))
+ltp_copy_pairs := \
+  $(call target-native-copy-pairs,$(kernel_ltp_modules),$(kernel_ltp_host_out))
+kselftest_copy_pairs := \
+  $(call target-native-copy-pairs,$(kernel_kselftest_modules),$(kernel_kselftest_host_out))
+copy_ltp_tests := $(call copy-many-files,$(ltp_copy_pairs))
+copy_kselftest_tests := $(call copy-many-files,$(kselftest_copy_pairs))
 
-# PHONY target to be used to build and test `vts_kernel_tests` without building full vts
-.PHONY: vts_kernel_tests
-vts_kernel_tests: $(copy_kernel_tests)
+# PHONY target to be used to build and test `vts_ltp_tests` and `vts_kselftest_tests` without building full vts
+.PHONY: vts_kernel_ltp_tests
+vts_kernel_ltp_tests: $(copy_ltp_tests)
 
-$(general_tests_zip) : $(copy_kernel_tests)
-$(general_tests_zip) : PRIVATE_KERNEL_TEST_HOST_OUT := $(kernel_test_host_out)
+.PHONY: vts_kernel_kselftest_tests
+vts_kernel_kselftest_tests: $(copy_kselftest_tests)
+
+$(general_tests_zip) : $(copy_ltp_tests)
+$(general_tests_zip) : $(copy_kselftest_tests)
+$(general_tests_zip) : PRIVATE_KERNEL_LTP_HOST_OUT := $(kernel_ltp_host_out)
+$(general_tests_zip) : PRIVATE_KERNEL_KSELFTEST_HOST_OUT := $(kernel_kselftest_host_out)
 $(general_tests_zip) : PRIVATE_general_tests_list_zip := $(general_tests_list_zip)
 $(general_tests_zip) : .KATI_IMPLICIT_OUTPUTS := $(general_tests_list_zip) $(general_tests_configs_zip) $(general_tests_host_shared_libs_zip)
 $(general_tests_zip) : PRIVATE_TOOLS := $(general_tests_tools)
@@ -64,7 +72,8 @@
 	rm -f $@ $(PRIVATE_general_tests_list_zip)
 	mkdir -p $(PRIVATE_INTERMEDIATES_DIR) $(PRIVATE_INTERMEDIATES_DIR)/tools
 	echo $(sort $(COMPATIBILITY.general-tests.FILES)) | tr " " "\n" > $(PRIVATE_INTERMEDIATES_DIR)/list
-	find $(PRIVATE_KERNEL_TEST_HOST_OUT) >> $(PRIVATE_INTERMEDIATES_DIR)/list
+	find $(PRIVATE_KERNEL_LTP_HOST_OUT) >> $(PRIVATE_INTERMEDIATES_DIR)/list
+	find $(PRIVATE_KERNEL_KSELFTEST_HOST_OUT) >> $(PRIVATE_INTERMEDIATES_DIR)/list
 	grep $(HOST_OUT_TESTCASES) $(PRIVATE_INTERMEDIATES_DIR)/list > $(PRIVATE_INTERMEDIATES_DIR)/host.list || true
 	grep $(TARGET_OUT_TESTCASES) $(PRIVATE_INTERMEDIATES_DIR)/list > $(PRIVATE_INTERMEDIATES_DIR)/target.list || true
 	grep -e .*\\.config$$ $(PRIVATE_INTERMEDIATES_DIR)/host.list > $(PRIVATE_INTERMEDIATES_DIR)/host-test-configs.list || true
diff --git a/core/tasks/tools/compatibility.mk b/core/tasks/tools/compatibility.mk
index e56e8ba..a5f162a 100644
--- a/core/tasks/tools/compatibility.mk
+++ b/core/tasks/tools/compatibility.mk
@@ -53,7 +53,7 @@
 $(test_suite_jdk): $(SOONG_ZIP)
 	$(SOONG_ZIP) -o $@ -P $(PRIVATE_SUBDIR)/jdk -C $(PRIVATE_JDK_DIR) -D $(PRIVATE_JDK_DIR)
 
-$(call declare-license-metadata,$(test_suite_jdk),SPDX-license-identifier-GPL-2.0-with-classpath-exception,restricted,\
+$(call declare-license-metadata,$(test_suite_jdk),SPDX-license-identifier-GPL-2.0-with-classpath-exception,permissive,\
   $(test_suite_jdk_dir)/legal/java.base/LICENSE,JDK,prebuilts/jdk/$(notdir $(patsubst %/,%,$(dir $(test_suite_jdk_dir)))))
 
 # Copy license metadata
diff --git a/core/tasks/tools/vts-kernel-tests.mk b/core/tasks/tools/vts-kernel-tests.mk
index 5fbb589..bd115c9 100644
--- a/core/tasks/tools/vts-kernel-tests.mk
+++ b/core/tasks/tools/vts-kernel-tests.mk
@@ -18,9 +18,12 @@
 include $(BUILD_SYSTEM)/tasks/tools/vts_package_utils.mk
 
 # Copy kernel test modules to testcases directories
-kernel_test_host_out := $(HOST_OUT_TESTCASES)/vts_kernel_tests
-kernel_test_vts_out := $(HOST_OUT)/$(test_suite_name)/android-$(test_suite_name)/testcases/vts_kernel_tests
-kernel_test_modules := \
-    $(kselftest_modules) \
+kernel_ltp_host_out := $(HOST_OUT_TESTCASES)/vts_kernel_ltp_tests
+kernel_ltp_vts_out := $(HOST_OUT)/$(test_suite_name)/android-$(test_suite_name)/testcases/vts_kernel_ltp_tests
+kernel_ltp_modules := \
     ltp \
-    $(ltp_packages)
\ No newline at end of file
+    $(ltp_packages)
+
+kernel_kselftest_host_out := $(HOST_OUT_TESTCASES)/vts_kernel_kselftest_tests
+kernel_kselftest_vts_out := $(HOST_OUT)/$(test_suite_name)/android-$(test_suite_name)/testcases/vts_kernel_kselftest_tests
+kernel_kselftest_modules := $(kselftest_modules)
diff --git a/core/tasks/vts-core-tests.mk b/core/tasks/vts-core-tests.mk
index 5e1b5d5..bd7652b 100644
--- a/core/tasks/vts-core-tests.mk
+++ b/core/tasks/vts-core-tests.mk
@@ -18,12 +18,15 @@
 
 include $(BUILD_SYSTEM)/tasks/tools/vts-kernel-tests.mk
 
-kernel_test_copy_pairs := \
-  $(call target-native-copy-pairs,$(kernel_test_modules),$(kernel_test_vts_out))
+ltp_copy_pairs := \
+  $(call target-native-copy-pairs,$(kernel_ltp_modules),$(kernel_ltp_vts_out))
+kselftest_copy_pairs := \
+  $(call target-native-copy-pairs,$(kernel_kselftest_modules),$(kernel_kselftest_vts_out))
 
-copy_kernel_tests := $(call copy-many-files,$(kernel_test_copy_pairs))
+copy_ltp_tests := $(call copy-many-files,$(ltp_copy_pairs))
+copy_kselftest_tests := $(call copy-many-files,$(kselftest_copy_pairs))
 
-test_suite_extra_deps := $(copy_kernel_tests)
+test_suite_extra_deps := $(copy_ltp_tests) $(copy_kselftest_tests)
 
 include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
 
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 710b871..075ebf0 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -82,7 +82,7 @@
 .KATI_READONLY := PLATFORM_SDK_EXTENSION_VERSION
 
 # This is the sdk extension version that PLATFORM_SDK_VERSION ships with.
-PLATFORM_BASE_SDK_EXTENSION_VERSION := 3
+PLATFORM_BASE_SDK_EXTENSION_VERSION := $(PLATFORM_SDK_EXTENSION_VERSION)
 .KATI_READONLY := PLATFORM_BASE_SDK_EXTENSION_VERSION
 
 # This are all known codenames.
diff --git a/envsetup.sh b/envsetup.sh
index a31dce5..9b47d3b 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -463,7 +463,7 @@
     # message, instead of FileNotFound.
     local T=$(multitree_gettop)
     if [ -n "$T" ]; then
-      "$T/build/build/make/orchestrator/core/orchestrator.py" "$@"
+      "$T/orchestrator/build/orchestrator/core/orchestrator.py" "$@"
     else
       _multitree_lunch_error
       return 1
@@ -471,7 +471,7 @@
     if $(echo "$1" | grep -q '^-') ; then
         # Calls starting with a -- argument are passed directly and the function
         # returns with the lunch.py exit code.
-        "${T}/build/build/make/orchestrator/core/lunch.py" "$@"
+        "${T}/orchestrator/build/orchestrator/core/lunch.py" "$@"
         code=$?
         if [[ $code -eq 2 ]] ; then
           echo 1>&2
@@ -482,7 +482,7 @@
         fi
     else
         # All other calls go through the --lunch variant of lunch.py
-        results=($(${T}/build/build/make/orchestrator/core/lunch.py --lunch "$@"))
+        results=($(${T}/orchestrator/build/orchestrator/core/lunch.py --lunch "$@"))
         code=$?
         if [[ $code -eq 2 ]] ; then
           echo 1>&2
@@ -978,7 +978,7 @@
 # TODO: Merge into gettop as part of launching multitree
 function multitree_gettop
 {
-    local TOPFILE=build/build/make/core/envsetup.mk
+    local TOPFILE=orchestrator/build/make/core/envsetup.mk
     if [ -n "$TOP" -a -f "$TOP/$TOPFILE" ] ; then
         # The following circumlocution ensures we remove symlinks from TOP.
         (cd "$TOP"; PWD= /bin/pwd)
@@ -1931,7 +1931,7 @@
 {
     local T=$(multitree_gettop)
     if [ -n "$T" ]; then
-      "$T/build/build/make/orchestrator/core/orchestrator.py" "$@"
+      "$T/orchestrator/build/orchestrator/core/orchestrator.py" "$@"
     else
       _multitree_lunch_error
       return 1
diff --git a/finalize-aidl-vndk-sdk-resources.sh b/finalize-aidl-vndk-sdk-resources.sh
new file mode 100755
index 0000000..5d4fbe3
--- /dev/null
+++ b/finalize-aidl-vndk-sdk-resources.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+set -ex
+
+function finalize_aidl_vndk_sdk_resources() {
+    local top="$(dirname "$0")"/../..
+
+    # default target to modify tree and build SDK
+    local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
+
+    # This script is WIP and only finalizes part of the Android branch for release.
+    # The full process can be found at (INTERNAL) go/android-sdk-finalization.
+
+    # VNDK snapshot (TODO)
+    # SDK snapshots (TODO)
+    # Update references in the codebase to new API version (TODO)
+    # ...
+
+    AIDL_TRANSITIVE_FREEZE=true $m aidl-freeze-api create_reference_dumps
+
+    # Generate ABI dumps
+    ANDROID_BUILD_TOP="$top" \
+        out/host/linux-x86/bin/create_reference_dumps \
+        -p aosp_arm64 --build-variant user
+
+    # Update new versions of files. See update-vndk-list.sh (which requires envsetup.sh)
+    $m check-vndk-list || \
+        { cp $top/out/soong/vndk/vndk.libraries.txt $top/build/make/target/product/gsi/current.txt; }
+
+    # Finalize resources
+    "$top/frameworks/base/tools/aapt2/tools/finalize_res.py" \
+           "$top/frameworks/base/core/res/res/values/public-staging.xml" \
+           "$top/frameworks/base/core/res/res/values/public-final.xml"
+
+    # SDK finalization
+    local sdk_codename='public static final int UPSIDE_DOWN_CAKE = CUR_DEVELOPMENT;'
+    local sdk_version='public static final int UPSIDE_DOWN_CAKE = 34;'
+    local sdk_build="$top/frameworks/base/core/java/android/os/Build.java"
+
+    sed -i "s%$sdk_codename%$sdk_version%g" $sdk_build
+
+    # Update the current.txt
+    $m update-api
+}
+
+finalize_aidl_vndk_sdk_resources
+
diff --git a/finalize-step-1.sh b/finalize-step-1.sh
new file mode 100755
index 0000000..e8afba4
--- /dev/null
+++ b/finalize-step-1.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+# Automation for finalize_branch_for_release.sh.
+# Sets up local environment, runs the finalization script and submits the results.
+# WIP:
+# - does not submit, only sends to gerrit.
+
+# set -ex
+
+function revert_local_changes() {
+    repo forall -c '\
+        git checkout . ; git clean -fdx ;\
+        git checkout @ ; git b fina-step1 -D ; git reset --hard; \
+        repo start fina-step1 ; git checkout @ ; git b fina-step1 -D ;\
+        previousHash="$(git log --format=%H --no-merges --max-count=1 --grep ^FINALIZATION_STEP_1_SCRIPT_COMMIT)" ;\
+        if [[ $previousHash ]]; then git revert --no-commit $previousHash ; fi ;'
+}
+
+function commit_changes() {
+    repo forall -c '\
+        if [[ $(git status --short) ]]; then
+            repo start fina-step1 ;
+            git add -A . ;
+            git commit -m FINALIZATION_STEP_1_SCRIPT_COMMIT -m WILL_BE_AUTOMATICALLY_REVERTED ;
+            repo upload --cbr --no-verify -t -y . ;
+            git clean -fdx ; git reset --hard ;
+        fi'
+}
+
+function finalize_step_1_main() {
+    local top="$(dirname "$0")"/../..
+
+    repo selfupdate
+
+    revert_local_changes
+
+    # vndk etc finalization
+    source $top/build/make/finalize-aidl-vndk-sdk-resources.sh
+
+    # move all changes to fina-step1 branch and commit with a robot message
+    commit_changes
+}
+
+finalize_step_1_main
diff --git a/finalize_branch_for_release.sh b/finalize_branch_for_release.sh
index ce90ac0..b46390d 100755
--- a/finalize_branch_for_release.sh
+++ b/finalize_branch_for_release.sh
@@ -8,28 +8,13 @@
     # default target to modify tree and build SDK
     local m="$top/build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=aosp_arm64 TARGET_BUILD_VARIANT=userdebug"
 
-    # This script is WIP and only finalizes part of the Android branch for release.
-    # The full process can be found at (INTERNAL) go/android-sdk-finalization.
-
-    # VNDK snapshot (TODO)
-    # SDK snapshots (TODO)
-    # Update references in the codebase to new API version (TODO)
-    # ...
-
-    AIDL_TRANSITIVE_FREEZE=true $m aidl-freeze-api create_reference_dumps
-
-    # Generate ABI dumps
-    ANDROID_BUILD_TOP="$top" \
-        out/host/linux-x86/bin/create_reference_dumps \
-        -p aosp_arm64 --build-variant user
-
-    # Update new versions of files. See update-vndk-list.sh (which requires envsetup.sh)
-    $m check-vndk-list || \
-        { cp $top/out/soong/vndk/vndk.libraries.txt $top/build/make/target/product/gsi/current.txt; }
+    # Build finalization artifacts.
+    source $top/build/make/finalize-aidl-vndk-sdk-resources.sh
 
     # This command tests:
     #   The release state for AIDL.
     #   ABI difference between user and userdebug builds.
+    #   Resource/SDK finalization.
     # In the future, we would want to actually turn the branch into the REL
     # state and test with that.
     AIDL_FROZEN_REL=true $m droidcore
@@ -40,3 +25,4 @@
 }
 
 finalize_main
+
diff --git a/help.sh b/help.sh
index e51adc1..c405959 100755
--- a/help.sh
+++ b/help.sh
@@ -26,6 +26,8 @@
     clean                   (aka clobber) equivalent to rm -rf out/
     checkbuild              Build every module defined in the source tree
     droid                   Default target
+    sync                    Build everything in the default target except the images,
+                            for use with adb sync.
     nothing                 Do not build anything, just parse and validate the build structure
 
     java                    Build all the java code in the source tree
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index cfda1e3..04a5ba2 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -69,7 +69,6 @@
     com.android.neuralnetworks \
     com.android.scheduling \
     com.android.sdkext \
-    com.android.sepolicy \
     com.android.tethering \
     com.android.tzdata \
     com.android.uwb \
@@ -376,7 +375,6 @@
 PRODUCT_PACKAGES_DEBUG := \
     adb_keys \
     arping \
-    com.android.sepolicy.cert-debug.der \
     dmuserd \
     idlcli \
     init-debug.rc \
diff --git a/tools/compliance/cmd/listshare/listshare.go b/tools/compliance/cmd/listshare/listshare.go
index 31bd1b2..4ca6457 100644
--- a/tools/compliance/cmd/listshare/listshare.go
+++ b/tools/compliance/cmd/listshare/listshare.go
@@ -149,6 +149,9 @@
 	// Group the resolutions by project.
 	presolution := make(map[string]compliance.LicenseConditionSet)
 	for _, target := range shareSource.AttachesTo() {
+		if shareSource.IsPureAggregate(target) && !target.LicenseConditions().MatchesAnySet(compliance.ImpliesShared) {
+			continue
+		}
 		rl := shareSource.Resolutions(target)
 		sort.Sort(rl)
 		for _, r := range rl {
diff --git a/tools/compliance/cmd/listshare/listshare_test.go b/tools/compliance/cmd/listshare/listshare_test.go
index c1e38be..fb61583 100644
--- a/tools/compliance/cmd/listshare/listshare_test.go
+++ b/tools/compliance/cmd/listshare/listshare_test.go
@@ -194,13 +194,6 @@
 					conditions: []string{"restricted"},
 				},
 				{
-					project: "highest/apex",
-					conditions: []string{
-						"restricted",
-						"restricted_allows_dynamic_linking",
-					},
-				},
-				{
 					project: "static/binary",
 					conditions: []string{
 						"restricted_allows_dynamic_linking",
@@ -225,13 +218,6 @@
 					conditions: []string{"restricted"},
 				},
 				{
-					project: "container/zip",
-					conditions: []string{
-						"restricted",
-						"restricted_allows_dynamic_linking",
-					},
-				},
-				{
 					project:    "device/library",
 					conditions: []string{"restricted_allows_dynamic_linking"},
 				},
@@ -320,10 +306,6 @@
 					project:    "dynamic/binary",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "highest/apex",
-					conditions: []string{"restricted"},
-				},
 			},
 		},
 		{
@@ -336,10 +318,6 @@
 					conditions: []string{"restricted"},
 				},
 				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
-				{
 					project:    "dynamic/binary",
 					conditions: []string{"restricted"},
 				},
@@ -381,10 +359,6 @@
 					project:    "bin/threelibraries",
 					conditions: []string{"restricted"},
 				},
-				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
 			},
 		},
 		{
@@ -397,10 +371,6 @@
 					conditions: []string{"restricted"},
 				},
 				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
-				{
 					project:    "lib/apache",
 					conditions: []string{"restricted"},
 				},
@@ -420,10 +390,6 @@
 					conditions: []string{"restricted"},
 				},
 				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
-				{
 					project:    "lib/apache",
 					conditions: []string{"restricted"},
 				},
@@ -447,10 +413,6 @@
 					conditions: []string{"restricted"},
 				},
 				{
-					project:    "container/zip",
-					conditions: []string{"restricted"},
-				},
-				{
 					project:    "lib/apache",
 					conditions: []string{"restricted"},
 				},
diff --git a/tools/compliance/condition.go b/tools/compliance/condition.go
index cfe6f82..3145249 100644
--- a/tools/compliance/condition.go
+++ b/tools/compliance/condition.go
@@ -23,7 +23,7 @@
 type LicenseCondition uint16
 
 // LicenseConditionMask is a bitmask for the recognized license conditions.
-const LicenseConditionMask = LicenseCondition(0x3ff)
+const LicenseConditionMask = LicenseCondition(0x1ff)
 
 const (
 	// UnencumberedCondition identifies public domain or public domain-
@@ -41,21 +41,18 @@
 	// RestrictedCondition identifies a license with requirement to share
 	// all source code linked to the module's source.
 	RestrictedCondition = LicenseCondition(0x0010)
-	// RestrictedClasspathExceptionCondition identifies RestrictedCondition
-	// waived for dynamic linking from independent modules.
-	RestrictedClasspathExceptionCondition = LicenseCondition(0x0020)
 	// WeaklyRestrictedCondition identifies a RestrictedCondition waived
 	// for dynamic linking.
-	WeaklyRestrictedCondition = LicenseCondition(0x0040)
+	WeaklyRestrictedCondition = LicenseCondition(0x0020)
 	// ProprietaryCondition identifies a license with source privacy
 	// requirements.
-	ProprietaryCondition = LicenseCondition(0x0080)
+	ProprietaryCondition = LicenseCondition(0x0040)
 	// ByExceptionOnly identifies a license where policy requires product
 	// counsel review prior to use.
-	ByExceptionOnlyCondition = LicenseCondition(0x0100)
+	ByExceptionOnlyCondition = LicenseCondition(0x0080)
 	// NotAllowedCondition identifies a license with onerous conditions
 	// where policy prohibits use.
-	NotAllowedCondition = LicenseCondition(0x0200)
+	NotAllowedCondition = LicenseCondition(0x0100)
 )
 
 var (
@@ -66,7 +63,6 @@
 		"notice":                              NoticeCondition,
 		"reciprocal":                          ReciprocalCondition,
 		"restricted":                          RestrictedCondition,
-		"restricted_with_classpath_exception": RestrictedClasspathExceptionCondition,
 		"restricted_allows_dynamic_linking":   WeaklyRestrictedCondition,
 		"proprietary":                         ProprietaryCondition,
 		"by_exception_only":                   ByExceptionOnlyCondition,
@@ -87,8 +83,6 @@
 		return "reciprocal"
 	case RestrictedCondition:
 		return "restricted"
-	case RestrictedClasspathExceptionCondition:
-		return "restricted_with_classpath_exception"
 	case WeaklyRestrictedCondition:
 		return "restricted_allows_dynamic_linking"
 	case ProprietaryCondition:
@@ -98,5 +92,5 @@
 	case NotAllowedCondition:
 		return "not_allowed"
 	}
-	panic(fmt.Errorf("unrecognized license condition: %04x", lc))
+	panic(fmt.Errorf("unrecognized license condition: %#v", lc))
 }
diff --git a/tools/compliance/condition_test.go b/tools/compliance/condition_test.go
index 778ce4a..16ec72c 100644
--- a/tools/compliance/condition_test.go
+++ b/tools/compliance/condition_test.go
@@ -21,22 +21,22 @@
 func TestConditionSetHas(t *testing.T) {
 	impliesShare := ImpliesShared
 
-	t.Logf("testing with imliesShare=%04x", impliesShare)
+	t.Logf("testing with imliesShare=%#v", impliesShare)
 
 	if impliesShare.HasAny(NoticeCondition) {
-		t.Errorf("impliesShare.HasAny(\"notice\"=%04x) got true, want false", NoticeCondition)
+		t.Errorf("impliesShare.HasAny(\"notice\"=%#v) got true, want false", NoticeCondition)
 	}
 
 	if !impliesShare.HasAny(RestrictedCondition) {
-		t.Errorf("impliesShare.HasAny(\"restricted\"=%04x) got false, want true", RestrictedCondition)
+		t.Errorf("impliesShare.HasAny(\"restricted\"=%#v) got false, want true", RestrictedCondition)
 	}
 
 	if !impliesShare.HasAny(ReciprocalCondition) {
-		t.Errorf("impliesShare.HasAny(\"reciprocal\"=%04x) got false, want true", ReciprocalCondition)
+		t.Errorf("impliesShare.HasAny(\"reciprocal\"=%#v) got false, want true", ReciprocalCondition)
 	}
 
 	if impliesShare.HasAny(LicenseCondition(0x0000)) {
-		t.Errorf("impliesShare.HasAny(nil=%04x) got true, want false", LicenseCondition(0x0000))
+		t.Errorf("impliesShare.HasAny(nil=%#v) got true, want false", LicenseCondition(0x0000))
 	}
 }
 
@@ -44,7 +44,7 @@
 	for expected, condition := range RecognizedConditionNames {
 		actual := condition.Name()
 		if expected != actual {
-			t.Errorf("unexpected name for condition %04x: got %s, want %s", condition, actual, expected)
+			t.Errorf("unexpected name for condition %#v: got %s, want %s", condition, actual, expected)
 		}
 	}
 }
@@ -62,6 +62,6 @@
 		t.Errorf("invalid condition unexpected name: got %s, wanted panic", name)
 	}()
 	if !panicked {
-		t.Errorf("no expected panic for %04x.Name(): got no panic, wanted panic", lc)
+		t.Errorf("no expected panic for %#v.Name(): got no panic, wanted panic", lc)
 	}
 }
diff --git a/tools/compliance/conditionset_test.go b/tools/compliance/conditionset_test.go
index c91912f..020cc0c 100644
--- a/tools/compliance/conditionset_test.go
+++ b/tools/compliance/conditionset_test.go
@@ -96,14 +96,13 @@
 		{
 			name:       "everything",
 			conditions: []string{"unencumbered", "permissive", "notice", "reciprocal", "restricted", "proprietary"},
-			plus:       &[]string{"restricted_with_classpath_exception", "restricted_allows_dynamic_linking", "by_exception_only", "not_allowed"},
+			plus:       &[]string{"restricted_allows_dynamic_linking", "by_exception_only", "not_allowed"},
 			matchingAny: map[string][]string{
 				"unencumbered":                        []string{"unencumbered"},
 				"permissive":                          []string{"permissive"},
 				"notice":                              []string{"notice"},
 				"reciprocal":                          []string{"reciprocal"},
 				"restricted":                          []string{"restricted"},
-				"restricted_with_classpath_exception": []string{"restricted_with_classpath_exception"},
 				"restricted_allows_dynamic_linking":   []string{"restricted_allows_dynamic_linking"},
 				"proprietary":                         []string{"proprietary"},
 				"by_exception_only":                   []string{"by_exception_only"},
@@ -116,7 +115,6 @@
 				"notice",
 				"reciprocal",
 				"restricted",
-				"restricted_with_classpath_exception",
 				"restricted_allows_dynamic_linking",
 				"proprietary",
 				"by_exception_only",
@@ -131,7 +129,6 @@
 				"notice",
 				"reciprocal",
 				"restricted",
-				"restricted_with_classpath_exception",
 				"restricted_allows_dynamic_linking",
 				"proprietary",
 				"by_exception_only",
@@ -151,7 +148,6 @@
 				"notice",
 				"reciprocal",
 				"restricted",
-				"restricted_with_classpath_exception",
 				"restricted_allows_dynamic_linking",
 				"proprietary",
 				"by_exception_only",
@@ -168,7 +164,6 @@
 				"notice":                              []string{"notice"},
 				"reciprocal":                          []string{"reciprocal"},
 				"restricted":                          []string{"restricted"},
-				"restricted_with_classpath_exception": []string{},
 				"restricted_allows_dynamic_linking":   []string{"restricted_allows_dynamic_linking"},
 				"proprietary":                         []string{"proprietary"},
 				"by_exception_only":                   []string{"by_exception_only"},
@@ -195,7 +190,6 @@
 				"notice",
 				"reciprocal",
 				"restricted",
-				"restricted_with_classpath_exception",
 				"restricted_allows_dynamic_linking",
 				"proprietary",
 				"by_exception_only",
@@ -208,7 +202,6 @@
 				"notice":                              []string{"notice"},
 				"reciprocal":                          []string{"reciprocal"},
 				"restricted":                          []string{"restricted"},
-				"restricted_with_classpath_exception": []string{"restricted_with_classpath_exception"},
 				"restricted_allows_dynamic_linking":   []string{},
 				"proprietary":                         []string{"proprietary"},
 				"by_exception_only":                   []string{"by_exception_only"},
@@ -221,7 +214,6 @@
 				"notice",
 				"reciprocal",
 				"restricted",
-				"restricted_with_classpath_exception",
 				"proprietary",
 				"by_exception_only",
 				"not_allowed",
@@ -235,7 +227,6 @@
 				"notice",
 				"reciprocal",
 				"restricted",
-				"restricted_with_classpath_exception",
 				"restricted_allows_dynamic_linking",
 				"proprietary",
 				"by_exception_only",
@@ -247,7 +238,6 @@
 				"notice",
 				"reciprocal",
 				"restricted",
-				"restricted_with_classpath_exception",
 				"restricted_allows_dynamic_linking",
 				"proprietary",
 				"by_exception_only",
@@ -259,7 +249,6 @@
 				"notice":                              []string{},
 				"reciprocal":                          []string{},
 				"restricted":                          []string{},
-				"restricted_with_classpath_exception": []string{},
 				"restricted_allows_dynamic_linking":   []string{},
 				"proprietary":                         []string{},
 				"by_exception_only":                   []string{},
@@ -270,21 +259,20 @@
 		},
 		{
 			name:       "restrictedplus",
-			conditions: []string{"restricted", "restricted_with_classpath_exception", "restricted_allows_dynamic_linking"},
+			conditions: []string{"restricted", "restricted_allows_dynamic_linking"},
 			plus:       &[]string{"permissive", "notice", "restricted", "proprietary"},
 			matchingAny: map[string][]string{
 				"unencumbered":                        []string{},
 				"permissive":                          []string{"permissive"},
 				"notice":                              []string{"notice"},
 				"restricted":                          []string{"restricted"},
-				"restricted_with_classpath_exception": []string{"restricted_with_classpath_exception"},
 				"restricted_allows_dynamic_linking":   []string{"restricted_allows_dynamic_linking"},
 				"proprietary":                         []string{"proprietary"},
 				"restricted|proprietary":              []string{"restricted", "proprietary"},
 				"by_exception_only":                   []string{},
 				"proprietary|by_exception_only":       []string{"proprietary"},
 			},
-			expected: []string{"permissive", "notice", "restricted", "restricted_with_classpath_exception", "restricted_allows_dynamic_linking", "proprietary"},
+			expected: []string{"permissive", "notice", "restricted", "restricted_allows_dynamic_linking", "proprietary"},
 		},
 	}
 	for _, tt := range tests {
@@ -342,11 +330,11 @@
 				actual := cs.MatchingAny(toConditions(strings.Split(data, "|"))...)
 				actualNames := actual.Names()
 
-				t.Logf("MatchingAny(%s): actual set %04x %s", data, actual, actual.String())
-				t.Logf("MatchingAny(%s): expected set %04x %s", data, expected, expected.String())
+				t.Logf("MatchingAny(%s): actual set %#v %s", data, actual, actual.String())
+				t.Logf("MatchingAny(%s): expected set %#v %s", data, expected, expected.String())
 
 				if actual != expected {
-					t.Errorf("MatchingAny(%s): got %04x, want %04x", data, actual, expected)
+					t.Errorf("MatchingAny(%s): got %#v, want %#v", data, actual, expected)
 					continue
 				}
 				if len(actualNames) != len(expectedNames) {
@@ -382,11 +370,11 @@
 				actual := cs.MatchingAnySet(NewLicenseConditionSet(toConditions(strings.Split(data, "|"))...))
 				actualNames := actual.Names()
 
-				t.Logf("MatchingAnySet(%s): actual set %04x %s", data, actual, actual.String())
-				t.Logf("MatchingAnySet(%s): expected set %04x %s", data, expected, expected.String())
+				t.Logf("MatchingAnySet(%s): actual set %#v %s", data, actual, actual.String())
+				t.Logf("MatchingAnySet(%s): expected set %#v %s", data, expected, expected.String())
 
 				if actual != expected {
-					t.Errorf("MatchingAnySet(%s): got %04x, want %04x", data, actual, expected)
+					t.Errorf("MatchingAnySet(%s): got %#v, want %#v", data, actual, expected)
 					continue
 				}
 				if len(actualNames) != len(expectedNames) {
@@ -426,11 +414,11 @@
 
 			actualNames := actual.Names()
 
-			t.Logf("actual license condition set: %04x %s", actual, actual.String())
-			t.Logf("expected license condition set: %04x %s", expected, expected.String())
+			t.Logf("actual license condition set: %#v %s", actual, actual.String())
+			t.Logf("expected license condition set: %#v %s", expected, expected.String())
 
 			if actual != expected {
-				t.Errorf("checkExpected: got %04x, want %04x", actual, expected)
+				t.Errorf("checkExpected: got %#v, want %#v", actual, expected)
 				return false
 			}
 
@@ -487,7 +475,7 @@
 
 			notExpected := (AllLicenseConditions &^ expected)
 			notExpectedList := notExpected.AsList()
-			t.Logf("not expected license condition set: %04x %s", notExpected, notExpected.String())
+			t.Logf("not expected license condition set: %#v %s", notExpected, notExpected.String())
 
 			if len(tt.expected) == 0 {
 				if actual.HasAny(append(expectedConditions, notExpectedList...)...) {
@@ -526,11 +514,11 @@
 
 			actualNames := actual.Names()
 
-			t.Logf("actual license condition set: %04x %s", actual, actual.String())
-			t.Logf("expected license condition set: %04x %s", expected, expected.String())
+			t.Logf("actual license condition set: %#v %s", actual, actual.String())
+			t.Logf("expected license condition set: %#v %s", expected, expected.String())
 
 			if actual != expected {
-				t.Errorf("checkExpectedSet: got %04x, want %04x", actual, expected)
+				t.Errorf("checkExpectedSet: got %#v, want %#v", actual, expected)
 				return false
 			}
 
@@ -581,7 +569,7 @@
 			}
 
 			notExpected := (AllLicenseConditions &^ expected)
-			t.Logf("not expected license condition set: %04x %s", notExpected, notExpected.String())
+			t.Logf("not expected license condition set: %#v %s", notExpected, notExpected.String())
 
 			if len(tt.expected) == 0 {
 				if actual.MatchesAnySet(expected, notExpected) {
@@ -606,10 +594,10 @@
 				t.Errorf("actual.Difference({expected}).IsEmpty(): want true, got false")
 			}
 			if expected != actual.Intersection(expected) {
-				t.Errorf("expected == actual.Intersection({expected}): want true, got false (%04x != %04x)", expected, actual.Intersection(expected))
+				t.Errorf("expected == actual.Intersection({expected}): want true, got false (%#v != %#v)", expected, actual.Intersection(expected))
 			}
 			if actual != actual.Intersection(expected) {
-				t.Errorf("actual == actual.Intersection({expected}): want true, got false (%04x != %04x)", actual, actual.Intersection(expected))
+				t.Errorf("actual == actual.Intersection({expected}): want true, got false (%#v != %#v)", actual, actual.Intersection(expected))
 			}
 			return true
 		}
diff --git a/tools/compliance/noticeindex.go b/tools/compliance/noticeindex.go
index f082383..50f808b 100644
--- a/tools/compliance/noticeindex.go
+++ b/tools/compliance/noticeindex.go
@@ -360,7 +360,8 @@
 						continue
 					}
 				}
-				for r, prefix := range SafePrebuiltPrefixes {
+				for _, r := range OrderedSafePrebuiltPrefixes {
+					prefix := SafePrebuiltPrefixes[r]
 					match := r.FindString(licenseText)
 					if len(match) == 0 {
 						continue
diff --git a/tools/compliance/policy_policy.go b/tools/compliance/policy_policy.go
index 60bdf48..2787698 100644
--- a/tools/compliance/policy_policy.go
+++ b/tools/compliance/policy_policy.go
@@ -16,6 +16,7 @@
 
 import (
 	"regexp"
+	"sort"
 	"strings"
 )
 
@@ -33,27 +34,32 @@
 	// proprietary or confidential pathnames to whether to strip the prefix
 	// from the path when used as the library name for notices.
 	SafePathPrefixes = map[string]bool{
-		"external/":    true,
-		"art/":         false,
-		"build/":       false,
-		"cts/":         false,
-		"dalvik/":      false,
-		"developers/":  false,
-		"development/": false,
-		"frameworks/":  false,
-		"packages/":    true,
-		"prebuilts/":   false,
-		"sdk/":         false,
-		"system/":      false,
-		"test/":        false,
-		"toolchain/":   false,
-		"tools/":       false,
+		"external/":             true,
+		"art/":                  false,
+		"build/":                false,
+		"cts/":                  false,
+		"dalvik/":               false,
+		"developers/":           false,
+		"development/":          false,
+		"frameworks/":           false,
+		"packages/":             true,
+		"prebuilts/module_sdk/": true,
+		"prebuilts/":            false,
+		"sdk/":                  false,
+		"system/":               false,
+		"test/":                 false,
+		"toolchain/":            false,
+		"tools/":                false,
 	}
 
 	// SafePrebuiltPrefixes maps the regular expression to match a prebuilt
 	// containing the path of a safe prefix to the safe prefix.
 	SafePrebuiltPrefixes = make(map[*regexp.Regexp]string)
 
+	// OrderedSafePrebuiltPrefixes lists the SafePrebuiltPrefixes ordered by
+	// increasing length.
+	OrderedSafePrebuiltPrefixes = make([]*regexp.Regexp, 0, 0)
+
 	// ImpliesUnencumbered lists the condition names representing an author attempt to disclaim copyright.
 	ImpliesUnencumbered = LicenseConditionSet(UnencumberedCondition)
 
@@ -62,14 +68,13 @@
 
 	// ImpliesNotice lists the condition names implying a notice or attribution policy.
 	ImpliesNotice = LicenseConditionSet(UnencumberedCondition | PermissiveCondition | NoticeCondition | ReciprocalCondition |
-		RestrictedCondition | RestrictedClasspathExceptionCondition | WeaklyRestrictedCondition |
-		ProprietaryCondition | ByExceptionOnlyCondition)
+		RestrictedCondition | WeaklyRestrictedCondition | ProprietaryCondition | ByExceptionOnlyCondition)
 
 	// ImpliesReciprocal lists the condition names implying a local source-sharing policy.
 	ImpliesReciprocal = LicenseConditionSet(ReciprocalCondition)
 
 	// Restricted lists the condition names implying an infectious source-sharing policy.
-	ImpliesRestricted = LicenseConditionSet(RestrictedCondition | RestrictedClasspathExceptionCondition | WeaklyRestrictedCondition)
+	ImpliesRestricted = LicenseConditionSet(RestrictedCondition | WeaklyRestrictedCondition)
 
 	// ImpliesProprietary lists the condition names implying a confidentiality policy.
 	ImpliesProprietary = LicenseConditionSet(ProprietaryCondition)
@@ -81,7 +86,7 @@
 	ImpliesPrivate = LicenseConditionSet(ProprietaryCondition)
 
 	// ImpliesShared lists the condition names implying a source-code sharing policy.
-	ImpliesShared = LicenseConditionSet(ReciprocalCondition | RestrictedCondition | RestrictedClasspathExceptionCondition | WeaklyRestrictedCondition)
+	ImpliesShared = LicenseConditionSet(ReciprocalCondition | RestrictedCondition | WeaklyRestrictedCondition)
 )
 
 var (
@@ -91,14 +96,33 @@
 	ccBySa       = regexp.MustCompile(`^SPDX-license-identifier-CC-BY.*-SA.*`)
 )
 
+// byIncreasingLength implements `sort.Interface` to order regular expressions by increasing length.
+type byIncreasingLength []*regexp.Regexp
+
+func (l byIncreasingLength) Len() int      { return len(l) }
+func (l byIncreasingLength) Swap(i, j int) { l[i], l[j] = l[j], l[i] }
+func (l byIncreasingLength) Less(i, j int) bool {
+	ri := l[i].String()
+	rj := l[j].String()
+	if len(ri) == len(rj) {
+		return ri < rj
+	}
+	return len(ri) < len(rj)
+}
+
 func init() {
 	for prefix := range SafePathPrefixes {
-		if prefix == "prebuilts/" {
+		if strings.HasPrefix(prefix, "prebuilts/") {
 			continue
 		}
-		r := regexp.MustCompile("^prebuilts/[^ ]*/" + prefix)
+		r := regexp.MustCompile("^prebuilts/(?:runtime/mainline/)?" + prefix)
 		SafePrebuiltPrefixes[r] = prefix
 	}
+	OrderedSafePrebuiltPrefixes = make([]*regexp.Regexp, 0, len(SafePrebuiltPrefixes))
+	for r := range SafePrebuiltPrefixes {
+		OrderedSafePrebuiltPrefixes = append(OrderedSafePrebuiltPrefixes, r)
+	}
+	sort.Sort(byIncreasingLength(OrderedSafePrebuiltPrefixes))
 }
 
 // LicenseConditionSetFromNames returns a set containing the recognized `names` and
@@ -112,13 +136,9 @@
 				continue
 			}
 			hasLgpl := false
-			hasClasspath := false
 			hasGeneric := false
 			for _, kind := range tn.LicenseKinds() {
-				if strings.HasSuffix(kind, "-with-classpath-exception") {
-					cs = cs.Plus(RestrictedClasspathExceptionCondition)
-					hasClasspath = true
-				} else if anyLgpl.MatchString(kind) {
+				if anyLgpl.MatchString(kind) {
 					cs = cs.Plus(WeaklyRestrictedCondition)
 					hasLgpl = true
 				} else if versionedGpl.MatchString(kind) {
@@ -131,7 +151,7 @@
 					cs = cs.Plus(RestrictedCondition)
 				}
 			}
-			if hasGeneric && !hasLgpl && !hasClasspath {
+			if hasGeneric && !hasLgpl {
 				cs = cs.Plus(RestrictedCondition)
 			}
 			continue
@@ -202,9 +222,6 @@
 	}
 
 	result |= depConditions & LicenseConditionSet(RestrictedCondition)
-	if 0 != (depConditions&LicenseConditionSet(RestrictedClasspathExceptionCondition)) && !edgeNodesAreIndependentModules(e) {
-		result |= LicenseConditionSet(RestrictedClasspathExceptionCondition)
-	}
 	return result
 }
 
@@ -241,9 +258,6 @@
 		return result
 	}
 	result = result.Minus(WeaklyRestrictedCondition)
-	if edgeNodesAreIndependentModules(e) {
-		result = result.Minus(RestrictedClasspathExceptionCondition)
-	}
 	return result
 }
 
@@ -261,10 +275,7 @@
 		return NewLicenseConditionSet()
 	}
 
-	result &= LicenseConditionSet(RestrictedCondition | RestrictedClasspathExceptionCondition)
-	if 0 != (result&LicenseConditionSet(RestrictedClasspathExceptionCondition)) && edgeNodesAreIndependentModules(e) {
-		result &= LicenseConditionSet(RestrictedCondition)
-	}
+	result &= LicenseConditionSet(RestrictedCondition)
 	return result
 }
 
@@ -281,9 +292,3 @@
 	isToolchain := e.annotations.HasAnnotation("toolchain")
 	return !isDynamic && !isToolchain
 }
-
-// edgeNodesAreIndependentModules returns true for edges where the target and
-// dependency are independent modules.
-func edgeNodesAreIndependentModules(e *TargetEdge) bool {
-	return e.target.PackageName() != e.dependency.PackageName()
-}
diff --git a/tools/compliance/policy_policy_test.go b/tools/compliance/policy_policy_test.go
index 27ce16c..94d0be3 100644
--- a/tools/compliance/policy_policy_test.go
+++ b/tools/compliance/policy_policy_test.go
@@ -85,19 +85,13 @@
 		{
 			name: "independentmodulestatic",
 			edge: annotated{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", []string{"static"}},
-			expectedDepActions: []string{
-				"apacheBin.meta_lic:gplWithClasspathException.meta_lic:restricted_with_classpath_exception",
-				"gplWithClasspathException.meta_lic:gplWithClasspathException.meta_lic:restricted_with_classpath_exception",
-			},
+			expectedDepActions: []string{},
 			expectedTargetConditions: []string{},
 		},
 		{
 			name: "dependentmodule",
 			edge: annotated{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", []string{"dynamic"}},
-			expectedDepActions: []string{
-				"dependentModule.meta_lic:gplWithClasspathException.meta_lic:restricted_with_classpath_exception",
-				"gplWithClasspathException.meta_lic:gplWithClasspathException.meta_lic:restricted_with_classpath_exception",
-			},
+			expectedDepActions: []string{},
 			expectedTargetConditions: []string{},
 		},
 
@@ -166,13 +160,13 @@
 			name:                     "independentmodulereversestatic",
 			edge:                     annotated{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"static"}},
 			expectedDepActions:       []string{},
-			expectedTargetConditions: []string{"gplWithClasspathException.meta_lic:restricted_with_classpath_exception"},
+			expectedTargetConditions: []string{},
 		},
 		{
 			name:                     "dependentmodulereverse",
 			edge:                     annotated{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			expectedDepActions:       []string{},
-			expectedTargetConditions: []string{"gplWithClasspathException.meta_lic:restricted_with_classpath_exception"},
+			expectedTargetConditions: []string{},
 		},
 		{
 			name: "ponr",
@@ -257,9 +251,9 @@
 						otherCs := otn.LicenseConditions()
 						depConditions |= otherCs
 					}
-					t.Logf("calculate target actions for edge=%s, dep conditions=%04x, treatAsAggregate=%v", edge.String(), depConditions, tt.treatAsAggregate)
+					t.Logf("calculate target actions for edge=%s, dep conditions=%#v %s, treatAsAggregate=%v", edge.String(), depConditions, depConditions, tt.treatAsAggregate)
 					csActual := depConditionsPropagatingToTarget(lg, edge, depConditions, tt.treatAsAggregate)
-					t.Logf("calculated target conditions as %04x{%s}", csActual, strings.Join(csActual.Names(), ", "))
+					t.Logf("calculated target conditions as %#v %s", csActual, csActual)
 					csExpected := NewLicenseConditionSet()
 					for _, triple := range tt.expectedDepActions {
 						fields := strings.Split(triple, ":")
@@ -269,9 +263,9 @@
 						}
 						csExpected |= expectedConditions
 					}
-					t.Logf("expected target conditions as %04x{%s}", csExpected, strings.Join(csExpected.Names(), ", "))
+					t.Logf("expected target conditions as %#v %s", csExpected, csExpected)
 					if csActual != csExpected {
-						t.Errorf("unexpected license conditions: got %04x, want %04x", csActual, csExpected)
+						t.Errorf("unexpected license conditions: got %#v, want %#v", csActual, csExpected)
 					}
 				})
 			}
diff --git a/tools/compliance/policy_resolve.go b/tools/compliance/policy_resolve.go
index d357aec..93335a9 100644
--- a/tools/compliance/policy_resolve.go
+++ b/tools/compliance/policy_resolve.go
@@ -65,9 +65,7 @@
 	// amap identifes targets previously walked. (guarded by mu)
 	amap := make(map[*TargetNode]struct{})
 
-	// cmap identifies targets previously walked as pure aggregates. i.e. as containers
-	// (guarded by mu)
-	cmap := make(map[*TargetNode]struct{})
+	// mu guards concurrent access to amap
 	var mu sync.Mutex
 
 	var walk func(target *TargetNode, treatAsAggregate bool) LicenseConditionSet
@@ -81,19 +79,16 @@
 				if treatAsAggregate {
 					return target.resolution, true
 				}
-				if _, asAggregate := cmap[target]; !asAggregate {
+				if !target.pure {
 					return target.resolution, true
 				}
 				// previously walked in a pure aggregate context,
 				// needs to walk again in non-aggregate context
-				delete(cmap, target)
 			} else {
 				target.resolution |= conditionsFn(target)
 				amap[target] = struct{}{}
 			}
-			if treatAsAggregate {
-				cmap[target] = struct{}{}
-			}
+			target.pure = treatAsAggregate
 			return target.resolution, false
 		}
 		cs, alreadyWalked := priorWalkResults()
@@ -169,11 +164,7 @@
 	// amap contains the set of targets already walked. (guarded by mu)
 	amap := make(map[*TargetNode]struct{})
 
-	// cmap contains the set of targets walked as pure aggregates. i.e. containers
-	// (guarded by mu)
-	cmap := make(map[*TargetNode]struct{})
-
-	// mu guards concurrent access to cmap
+	// mu guards concurrent access to amap
 	var mu sync.Mutex
 
 	var walk func(fnode *TargetNode, cs LicenseConditionSet, treatAsAggregate bool)
@@ -183,10 +174,8 @@
 		mu.Lock()
 		fnode.resolution |= conditionsFn(fnode)
 		fnode.resolution |= cs
+		fnode.pure = treatAsAggregate
 		amap[fnode] = struct{}{}
-		if treatAsAggregate {
-			cmap[fnode] = struct{}{}
-		}
 		cs = fnode.resolution
 		mu.Unlock()
 		// for each dependency
@@ -208,11 +197,10 @@
 							return
 						}
 						// non-aggregates don't need walking as non-aggregate a 2nd time
-						if _, asAggregate := cmap[dnode]; !asAggregate {
+						if !dnode.pure {
 							return
 						}
 						// previously walked as pure aggregate; need to re-walk as non-aggregate
-						delete(cmap, dnode)
 					}
 				}
 				// add the conditions to the dependency
diff --git a/tools/compliance/policy_resolve_test.go b/tools/compliance/policy_resolve_test.go
index f98e4cc..d6731fe 100644
--- a/tools/compliance/policy_resolve_test.go
+++ b/tools/compliance/policy_resolve_test.go
@@ -289,8 +289,8 @@
 				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", []string{"static"}},
 			},
 			expectedActions: []tcond{
-				{"apacheBin.meta_lic", "notice|restricted_with_classpath_exception"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
+				{"apacheBin.meta_lic", "notice"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -300,8 +300,8 @@
 				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", []string{"static"}},
 			},
 			expectedActions: []tcond{
-				{"dependentModule.meta_lic", "notice|restricted_with_classpath_exception"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
+				{"dependentModule.meta_lic", "notice"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -312,7 +312,7 @@
 			},
 			expectedActions: []tcond{
 				{"apacheBin.meta_lic", "notice"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -322,8 +322,8 @@
 				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", []string{"dynamic"}},
 			},
 			expectedActions: []tcond{
-				{"dependentModule.meta_lic", "notice|restricted_with_classpath_exception"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
+				{"dependentModule.meta_lic", "notice"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 	}
@@ -593,9 +593,9 @@
 				{"apacheBin.meta_lic", "mitLib.meta_lic", []string{"static"}},
 			},
 			expectedActions: []tcond{
-				{"apacheBin.meta_lic", "notice|restricted_with_classpath_exception"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
-				{"mitLib.meta_lic", "notice|restricted_with_classpath_exception"},
+				{"apacheBin.meta_lic", "notice"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
+				{"mitLib.meta_lic", "notice"},
 			},
 		},
 		{
@@ -606,9 +606,9 @@
 				{"dependentModule.meta_lic", "mitLib.meta_lic", []string{"static"}},
 			},
 			expectedActions: []tcond{
-				{"dependentModule.meta_lic", "notice|restricted_with_classpath_exception"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
-				{"mitLib.meta_lic", "notice|restricted_with_classpath_exception"},
+				{"dependentModule.meta_lic", "notice"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
+				{"mitLib.meta_lic", "notice"},
 			},
 		},
 		{
@@ -620,7 +620,7 @@
 			},
 			expectedActions: []tcond{
 				{"apacheBin.meta_lic", "notice"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
 				{"mitLib.meta_lic", "notice"},
 			},
 		},
@@ -632,9 +632,9 @@
 				{"dependentModule.meta_lic", "mitLib.meta_lic", []string{"static"}},
 			},
 			expectedActions: []tcond{
-				{"dependentModule.meta_lic", "notice|restricted_with_classpath_exception"},
-				{"gplWithClasspathException.meta_lic", "restricted_with_classpath_exception"},
-				{"mitLib.meta_lic", "notice|restricted_with_classpath_exception"},
+				{"dependentModule.meta_lic", "notice"},
+				{"gplWithClasspathException.meta_lic", "permissive"},
+				{"mitLib.meta_lic", "notice"},
 			},
 		},
 	}
diff --git a/tools/compliance/policy_resolvenotices_test.go b/tools/compliance/policy_resolvenotices_test.go
index cd9dd71..ee5e3b8 100644
--- a/tools/compliance/policy_resolvenotices_test.go
+++ b/tools/compliance/policy_resolvenotices_test.go
@@ -375,10 +375,8 @@
 			},
 			expectedResolutions: []res{
 				{"apacheBin.meta_lic", "apacheBin.meta_lic", "apacheBin.meta_lic", "notice"},
-				{"apacheBin.meta_lic", "apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 				{"apacheBin.meta_lic", "mitLib.meta_lic", "mitLib.meta_lic", "notice"},
-				{"apacheBin.meta_lic", "mitLib.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 			},
 		},
 		{
@@ -390,10 +388,8 @@
 			},
 			expectedResolutions: []res{
 				{"dependentModule.meta_lic", "dependentModule.meta_lic", "dependentModule.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 				{"dependentModule.meta_lic", "mitLib.meta_lic", "mitLib.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "mitLib.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 			},
 		},
 		{
@@ -418,7 +414,7 @@
 			expectedResolutions: []res{
 				{"apacheBin.meta_lic", "apacheBin.meta_lic", "apacheBin.meta_lic", "notice"},
 				{"apacheBin.meta_lic", "mitLib.meta_lic", "mitLib.meta_lic", "notice"},
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -430,9 +426,7 @@
 			},
 			expectedResolutions: []res{
 				{"dependentModule.meta_lic", "dependentModule.meta_lic", "dependentModule.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 				{"dependentModule.meta_lic", "mitLib.meta_lic", "mitLib.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "mitLib.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 			},
 		},
 		{
@@ -444,11 +438,8 @@
 			},
 			expectedResolutions: []res{
 				{"dependentModule.meta_lic", "dependentModule.meta_lic", "dependentModule.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 				{"dependentModule.meta_lic", "mitLib.meta_lic", "mitLib.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "mitLib.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 	}
diff --git a/tools/compliance/policy_resolveshare_test.go b/tools/compliance/policy_resolveshare_test.go
index c451b86..d49dfa8 100644
--- a/tools/compliance/policy_resolveshare_test.go
+++ b/tools/compliance/policy_resolveshare_test.go
@@ -40,9 +40,7 @@
 			edges: []annotated{
 				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "independentmodulestaticrestricted",
@@ -50,10 +48,7 @@
 			edges: []annotated{
 				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", []string{"static"}},
 			},
-			expectedResolutions: []res{
-				{"apacheBin.meta_lic", "apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "dependentmodulerestricted",
@@ -61,9 +56,7 @@
 			edges: []annotated{
 				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "dependentmodulerestrictedshipclasspath",
@@ -71,11 +64,7 @@
 			edges: []annotated{
 				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "lgplonfprestricted",
@@ -185,9 +174,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "independentmodulereversestaticrestricted",
@@ -195,10 +182,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"static"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "dependentmodulereverserestricted",
@@ -206,9 +190,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "dependentmodulereverserestrictedshipdependent",
@@ -216,11 +198,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:  "ponrrestricted",
diff --git a/tools/compliance/policy_shareprivacyconflicts.go b/tools/compliance/policy_shareprivacyconflicts.go
index 279e179..947bb96 100644
--- a/tools/compliance/policy_shareprivacyconflicts.go
+++ b/tools/compliance/policy_shareprivacyconflicts.go
@@ -49,7 +49,11 @@
 
 	// size is the size of the result
 	size := 0
-	for _, cs := range combined {
+	for actsOn, cs := range combined {
+		if actsOn.pure && !actsOn.LicenseConditions().MatchesAnySet(ImpliesShared) {
+			// no need to share code to build "a distribution medium"
+			continue
+		}
 		size += cs.Intersection(ImpliesShared).Len() * cs.Intersection(ImpliesPrivate).Len()
 	}
 	if size == 0 {
@@ -57,6 +61,9 @@
 	}
 	result := make([]SourceSharePrivacyConflict, 0, size)
 	for actsOn, cs := range combined {
+		if actsOn.pure { // no need to share code for "a distribution medium"
+			continue
+		}
 		pconditions := cs.Intersection(ImpliesPrivate).AsList()
 		ssconditions := cs.Intersection(ImpliesShared).AsList()
 
diff --git a/tools/compliance/policy_walk.go b/tools/compliance/policy_walk.go
index f4d7bba..beb6d53 100644
--- a/tools/compliance/policy_walk.go
+++ b/tools/compliance/policy_walk.go
@@ -45,7 +45,7 @@
 }
 
 // VisitNode is called for each root and for each walked dependency node by
-// WalkTopDown. When VisitNode returns true, WalkTopDown will proceed to walk
+// WalkTopDown and WalkTopDownBreadthFirst. When VisitNode returns true, WalkTopDown will proceed to walk
 // down the dependences of the node
 type VisitNode func(lg *LicenseGraph, target *TargetNode, path TargetEdgePath) bool
 
@@ -79,6 +79,54 @@
 	}
 }
 
+// WalkTopDownBreadthFirst performs a Breadth-first top down walk of `lg` calling `visit` and descending
+// into depenencies when `visit` returns true.
+func WalkTopDownBreadthFirst(ctx EdgeContextProvider, lg *LicenseGraph, visit VisitNode) {
+	path := NewTargetEdgePath(32)
+
+	var walk func(fnode *TargetNode)
+	walk = func(fnode *TargetNode) {
+		edgesToWalk := make(TargetEdgeList, 0, len(fnode.edges))
+		for _, edge := range fnode.edges {
+			var edgeContext interface{}
+			if ctx == nil {
+				edgeContext = nil
+			} else {
+				edgeContext = ctx.Context(lg, *path, edge)
+			}
+			path.Push(edge, edgeContext)
+			if visit(lg, edge.dependency, *path){
+				edgesToWalk = append(edgesToWalk, edge)
+			}
+			path.Pop()
+		}
+
+		for _, edge := range(edgesToWalk) {
+			var edgeContext interface{}
+			if ctx == nil {
+				edgeContext = nil
+			} else {
+				edgeContext = ctx.Context(lg, *path, edge)
+			}
+			path.Push(edge, edgeContext)
+			walk(edge.dependency)
+			path.Pop()
+		}
+	}
+
+	path.Clear()
+	rootsToWalk := make([]*TargetNode, 0, len(lg.rootFiles))
+	for _, r := range lg.rootFiles {
+		if visit(lg, lg.targets[r], *path){
+			rootsToWalk = append(rootsToWalk, lg.targets[r])
+		}
+	}
+
+	for _, rnode := range(rootsToWalk) {
+		walk(rnode)
+	}
+}
+
 // resolutionKey identifies results from walking a specific target for a
 // specific set of conditions.
 type resolutionKey struct {
diff --git a/tools/compliance/policy_walk_test.go b/tools/compliance/policy_walk_test.go
index 92867f9..0bc37f8 100644
--- a/tools/compliance/policy_walk_test.go
+++ b/tools/compliance/policy_walk_test.go
@@ -16,9 +16,22 @@
 
 import (
 	"bytes"
+	"fmt"
+	"os"
+	"strings"
 	"testing"
 )
 
+func TestMain(m *testing.M) {
+	// Change into the cmd directory before running the tests
+	// so they can find the testdata directory.
+	if err := os.Chdir("cmd"); err != nil {
+		fmt.Printf("failed to change to testdata directory: %s\n", err)
+		os.Exit(1)
+	}
+	os.Exit(m.Run())
+}
+
 func TestWalkResolutionsForCondition(t *testing.T) {
 	tests := []struct {
 		name                string
@@ -104,8 +117,7 @@
 			},
 			expectedResolutions: []res{
 				{"apacheBin.meta_lic", "apacheBin.meta_lic", "apacheBin.meta_lic", "notice"},
-				{"apacheBin.meta_lic", "apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -115,10 +127,7 @@
 			edges: []annotated{
 				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", []string{"static"}},
 			},
-			expectedResolutions: []res{
-				{"apacheBin.meta_lic", "apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:      "dependentmodulenotice",
@@ -129,7 +138,6 @@
 			},
 			expectedResolutions: []res{
 				{"dependentModule.meta_lic", "dependentModule.meta_lic", "dependentModule.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 			},
 		},
 		{
@@ -139,9 +147,7 @@
 			edges: []annotated{
 				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:      "lgplonfpnotice",
@@ -347,7 +353,7 @@
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"dynamic"}},
 			},
 			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -357,9 +363,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:      "independentmodulereverserestrictedshipped",
@@ -368,9 +372,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:      "independentmodulereversestaticnotice",
@@ -380,9 +382,8 @@
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"static"}},
 			},
 			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", "apacheBin.meta_lic", "notice"},
-				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 			},
 		},
 		{
@@ -392,10 +393,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"static"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:      "dependentmodulereversenotice",
@@ -405,7 +403,7 @@
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
 			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -415,9 +413,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:      "dependentmodulereverserestrictedshipped",
@@ -426,11 +422,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
-			expectedResolutions: []res{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"dependentModule.meta_lic", "dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedResolutions: []res{},
 		},
 		{
 			name:      "ponrnotice",
@@ -716,8 +708,7 @@
 			},
 			expectedActions: []act{
 				{"apacheBin.meta_lic", "apacheBin.meta_lic", "notice"},
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -727,10 +718,7 @@
 			edges: []annotated{
 				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", []string{"static"}},
 			},
-			expectedActions: []act{
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedActions: []act{},
 		},
 		{
 			name:      "dependentmodulenotice",
@@ -741,7 +729,6 @@
 			},
 			expectedActions: []act{
 				{"dependentModule.meta_lic", "dependentModule.meta_lic", "notice"},
-				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 			},
 		},
 		{
@@ -751,9 +738,7 @@
 			edges: []annotated{
 				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", []string{"dynamic"}},
 			},
-			expectedActions: []act{
-				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedActions: []act{},
 		},
 		{
 			name:      "lgplonfpnotice",
@@ -956,7 +941,7 @@
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"dynamic"}},
 			},
 			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -966,9 +951,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"dynamic"}},
 			},
-			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedActions: []act{},
 		},
 		{
 			name:      "independentmodulereverserestrictedshipped",
@@ -977,9 +960,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"dynamic"}},
 			},
-			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedActions: []act{},
 		},
 		{
 			name:      "independentmodulereversestaticnotice",
@@ -989,9 +970,8 @@
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"static"}},
 			},
 			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 				{"apacheBin.meta_lic", "apacheBin.meta_lic", "notice"},
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
 			},
 		},
 		{
@@ -1001,10 +981,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "apacheBin.meta_lic", []string{"static"}},
 			},
-			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"apacheBin.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedActions: []act{},
 		},
 		{
 			name:      "dependentmodulereversenotice",
@@ -1014,7 +991,7 @@
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
 			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
+				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "permissive"},
 			},
 		},
 		{
@@ -1024,9 +1001,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
-			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedActions: []act{},
 		},
 		{
 			name:      "dependentmodulereverserestrictedshipped",
@@ -1035,10 +1010,7 @@
 			edges: []annotated{
 				{"gplWithClasspathException.meta_lic", "dependentModule.meta_lic", []string{"dynamic"}},
 			},
-			expectedActions: []act{
-				{"gplWithClasspathException.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-				{"dependentModule.meta_lic", "gplWithClasspathException.meta_lic", "restricted"},
-			},
+			expectedActions: []act{},
 		},
 		{
 			name:      "ponrnotice",
@@ -1238,3 +1210,417 @@
 		})
 	}
 }
+
+func TestWalkTopDownBreadthFirst(t *testing.T) {
+	tests := []struct {
+		name           string
+		roots          []string
+		edges          []annotated
+		expectedResult []string
+	}{
+		{
+			name:  "bin/bin1",
+			roots: []string{"bin/bin1.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin2",
+			roots: []string{"bin/bin2.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin3",
+			roots: []string{"bin/bin3.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin3.meta_lic",
+			},
+		},
+		{
+			name:  "lib/liba.so",
+			roots: []string{"lib/liba.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/liba.so.meta_lic",
+			},
+		},
+		{
+			name:  "lib/libb.so",
+			roots: []string{"lib/libb.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/libb.so.meta_lic",
+			},
+		},
+		{
+			name:  "lib/libc.so",
+			roots: []string{"lib/libc.a.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/libc.a.meta_lic",
+			},
+		},
+		{
+			name:  "lib/libd.so",
+			roots: []string{"lib/libd.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "highest.apex",
+			roots: []string{"highest.apex.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/highest.apex.meta_lic",
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "container.zip",
+			roots: []string{"container.zip.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/container.zip.meta_lic",
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "application",
+			roots: []string{"application.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/application.meta_lic",
+				"testdata/notice/bin/bin3.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin1&lib/liba",
+			roots: []string{"bin/bin1.meta_lic","lib/liba.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin2&lib/libd",
+			roots: []string{"bin/bin2.meta_lic", "lib/libd.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "application&bin/bin3",
+			roots: []string{"application.meta_lic", "bin/bin3.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/application.meta_lic",
+				"testdata/notice/bin/bin3.meta_lic",
+				"testdata/notice/bin/bin3.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+			},
+		},
+		{
+			name:  "highest.apex&container.zip",
+			roots: []string{"highest.apex.meta_lic", "container.zip.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/highest.apex.meta_lic",
+				"testdata/notice/container.zip.meta_lic",
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			stderr := &bytes.Buffer{}
+			actualOut := &bytes.Buffer{}
+
+			rootFiles := make([]string, 0, len(tt.roots))
+			for _, r := range tt.roots {
+				rootFiles = append(rootFiles, "testdata/notice/"+r)
+			}
+
+			lg, err := ReadLicenseGraph(GetFS(""), stderr, rootFiles)
+
+			if err != nil {
+				t.Errorf("unexpected test data error: got %s, want no error", err)
+				return
+			}
+
+			expectedRst := tt.expectedResult
+
+			WalkTopDownBreadthFirst(nil, lg, func(lg *LicenseGraph, tn *TargetNode, path TargetEdgePath) bool {
+				fmt.Fprintln(actualOut, tn.Name())
+				return true
+			})
+
+			actualRst := strings.Split(actualOut.String(), "\n")
+
+			if len(actualRst) > 0 {
+				actualRst = actualRst[:len(actualRst)-1]
+			}
+
+			t.Logf("actual nodes visited: %s", actualOut.String())
+			t.Logf("expected nodes visited: %s", strings.Join(expectedRst, "\n"))
+
+			if len(actualRst) != len(expectedRst) {
+				t.Errorf("WalkTopDownBreadthFirst: number of visited nodes is different: got %d, want %d", len(actualRst), len(expectedRst))
+			}
+
+			for i := 0; i < len(actualRst) && i < len(expectedRst); i++ {
+				if actualRst[i] != expectedRst[i] {
+					t.Errorf("WalkTopDownBreadthFirst: lines differ at index %d: got %q, want %q", i, actualRst[i], expectedRst[i])
+					break
+				}
+			}
+
+			if len(actualRst) < len(expectedRst) {
+				t.Errorf("WalkTopDownBreadthFirst: extra lines at %d: got %q, want nothing", len(actualRst), expectedRst[len(actualRst)])
+			}
+
+			if len(expectedRst) < len(actualRst) {
+				t.Errorf("WalkTopDownBreadthFirst: missing lines at %d: got nothing, want %q", len(expectedRst), actualRst[len(expectedRst)])
+			}
+		})
+	}
+}
+
+func TestWalkTopDownBreadthFirstWithoutDuplicates(t *testing.T) {
+	tests := []struct {
+		name           string
+		roots          []string
+		edges          []annotated
+		expectedResult []string
+	}{
+		{
+			name:  "bin/bin1",
+			roots: []string{"bin/bin1.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin2",
+			roots: []string{"bin/bin2.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin3",
+			roots: []string{"bin/bin3.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin3.meta_lic",
+			},
+		},
+		{
+			name:  "lib/liba.so",
+			roots: []string{"lib/liba.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/liba.so.meta_lic",
+			},
+		},
+		{
+			name:  "lib/libb.so",
+			roots: []string{"lib/libb.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/libb.so.meta_lic",
+			},
+		},
+		{
+			name:  "lib/libc.so",
+			roots: []string{"lib/libc.a.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/libc.a.meta_lic",
+			},
+		},
+		{
+			name:  "lib/libd.so",
+			roots: []string{"lib/libd.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "highest.apex",
+			roots: []string{"highest.apex.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/highest.apex.meta_lic",
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "container.zip",
+			roots: []string{"container.zip.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/container.zip.meta_lic",
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+		{
+			name:  "application",
+			roots: []string{"application.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/application.meta_lic",
+				"testdata/notice/bin/bin3.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin1&lib/liba",
+			roots: []string{"bin/bin1.meta_lic", "lib/liba.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+			},
+		},
+		{
+			name:  "bin/bin2&lib/libd",
+			roots: []string{"bin/bin2.meta_lic", "lib/libd.so.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+			},
+		},
+		{
+			name:  "application&bin/bin3",
+			roots: []string{"application.meta_lic", "bin/bin3.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/application.meta_lic",
+				"testdata/notice/bin/bin3.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+			},
+		},
+		{
+			name:  "highest.apex&container.zip",
+			roots: []string{"highest.apex.meta_lic", "container.zip.meta_lic"},
+			expectedResult: []string{
+				"testdata/notice/highest.apex.meta_lic",
+				"testdata/notice/container.zip.meta_lic",
+				"testdata/notice/bin/bin1.meta_lic",
+				"testdata/notice/bin/bin2.meta_lic",
+				"testdata/notice/lib/liba.so.meta_lic",
+				"testdata/notice/lib/libb.so.meta_lic",
+				"testdata/notice/lib/libc.a.meta_lic",
+				"testdata/notice/lib/libd.so.meta_lic",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			stderr := &bytes.Buffer{}
+			actualOut := &bytes.Buffer{}
+
+			rootFiles := make([]string, 0, len(tt.roots))
+			for _, r := range tt.roots {
+				rootFiles = append(rootFiles, "testdata/notice/"+r)
+			}
+
+			lg, err := ReadLicenseGraph(GetFS(""), stderr, rootFiles)
+
+			if err != nil {
+				t.Errorf("unexpected test data error: got %s, want no error", err)
+				return
+			}
+
+			expectedRst := tt.expectedResult
+
+			//Keeping track of the visited nodes
+			//Only add to actualOut if not visited
+			visitedNodes := make(map[string]struct{})
+			WalkTopDownBreadthFirst(nil, lg, func(lg *LicenseGraph, tn *TargetNode, path TargetEdgePath) bool {
+				if _, alreadyVisited := visitedNodes[tn.Name()]; alreadyVisited {
+					return false
+				}
+				fmt.Fprintln(actualOut, tn.Name())
+				visitedNodes[tn.Name()] = struct{}{}
+				return true
+			})
+
+			actualRst := strings.Split(actualOut.String(), "\n")
+
+			if len(actualRst) > 0 {
+				actualRst = actualRst[:len(actualRst)-1]
+			}
+
+			t.Logf("actual nodes visited: %s", actualOut.String())
+			t.Logf("expected nodes visited: %s", strings.Join(expectedRst, "\n"))
+
+			if len(actualRst) != len(expectedRst) {
+				t.Errorf("WalkTopDownBreadthFirst: number of visited nodes is different: got %d, want %d", len(actualRst), len(expectedRst))
+			}
+
+			for i := 0; i < len(actualRst) && i < len(expectedRst); i++ {
+				if actualRst[i] != expectedRst[i] {
+					t.Errorf("WalkTopDownBreadthFirst: lines differ at index %d: got %q, want %q", i, actualRst[i], expectedRst[i])
+					break
+				}
+			}
+
+			if len(actualRst) < len(expectedRst) {
+				t.Errorf("WalkTopDownBreadthFirst: extra lines at %d: got %q, want nothing", len(actualRst), expectedRst[len(actualRst)])
+			}
+
+			if len(expectedRst) < len(actualRst) {
+				t.Errorf("WalkTopDownBreadthFirst: missing lines at %d: got nothing, want %q", len(expectedRst), actualRst[len(expectedRst)])
+			}
+		})
+	}
+}
diff --git a/tools/compliance/readgraph.go b/tools/compliance/readgraph.go
index 7516440..7faca86 100644
--- a/tools/compliance/readgraph.go
+++ b/tools/compliance/readgraph.go
@@ -198,6 +198,9 @@
 
 	// resolution identifies the set of conditions resolved by acting on the target node.
 	resolution LicenseConditionSet
+
+	// pure indicates whether to treat the node as a pure aggregate (no internal linkage)
+	pure bool
 }
 
 // addDependencies converts the proto AnnotatedDependencies into `edges`
diff --git a/tools/compliance/resolutionset.go b/tools/compliance/resolutionset.go
index 7c8f333..1be4a34 100644
--- a/tools/compliance/resolutionset.go
+++ b/tools/compliance/resolutionset.go
@@ -72,6 +72,16 @@
 	return isPresent
 }
 
+// IsPureAggregate returns true if `target`, which must be in
+// `AttachesTo()` resolves to a pure aggregate in the resolution.
+func (rs ResolutionSet) IsPureAggregate(target *TargetNode) bool {
+	_, isPresent := rs[target]
+	if !isPresent {
+		panic(fmt.Errorf("ResolutionSet.IsPureAggregate(%s): not attached to %s", target.Name(), target.Name()))
+	}
+	return target.pure
+}
+
 // Resolutions returns the list of resolutions that `attachedTo`
 // target must resolve. Returns empty list if no conditions apply.
 func (rs ResolutionSet) Resolutions(attachesTo *TargetNode) ResolutionList {
diff --git a/tools/compliance/test_util.go b/tools/compliance/test_util.go
index 26d7461..c9d6fe2 100644
--- a/tools/compliance/test_util.go
+++ b/tools/compliance/test_util.go
@@ -42,7 +42,7 @@
 	Classpath = `` +
 		`package_name: "Free Software"
 license_kinds: "SPDX-license-identifier-GPL-2.0-with-classpath-exception"
-license_conditions: "restricted"
+license_conditions: "permissive"
 `
 
 	// DependentModule starts a test metadata file for a module in the same package as `Classpath`.
@@ -521,7 +521,7 @@
 			expectedConditions := expectedRl[i].Resolves()
 			actualConditions := actualRl[i].Resolves()
 			if expectedConditions != actualConditions {
-				t.Errorf("unexpected conditions apply to %q acting on %q: got %04x with names %s, want %04x with names %s",
+				t.Errorf("unexpected conditions apply to %q acting on %q: got %#v with names %s, want %#v with names %s",
 					target.name, expectedRl[i].actsOn.name,
 					actualConditions, actualConditions.Names(),
 					expectedConditions, expectedConditions.Names())
@@ -586,7 +586,7 @@
 			expectedConditions := expectedRl[i].Resolves()
 			actualConditions := actualRl[i].Resolves()
 			if expectedConditions != (expectedConditions & actualConditions) {
-				t.Errorf("expected conditions missing from %q acting on %q: got %04x with names %s, want %04x with names %s",
+				t.Errorf("expected conditions missing from %q acting on %q: got %#v with names %s, want %#v with names %s",
 					target.name, expectedRl[i].actsOn.name,
 					actualConditions, actualConditions.Names(),
 					expectedConditions, expectedConditions.Names())
diff --git a/tools/releasetools/ota_metadata_pb2.py b/tools/releasetools/ota_metadata_pb2.py
index 2552464..012d9ab 100644
--- a/tools/releasetools/ota_metadata_pb2.py
+++ b/tools/releasetools/ota_metadata_pb2.py
@@ -19,8 +19,8 @@
   name='ota_metadata.proto',
   package='build.tools.releasetools',
   syntax='proto3',
-  serialized_options=_b('H\003'),
-  serialized_pb=_b('\n\x12ota_metadata.proto\x12\x18\x62uild.tools.releasetools\"X\n\x0ePartitionState\x12\x16\n\x0epartition_name\x18\x01 \x01(\t\x12\x0e\n\x06\x64\x65vice\x18\x02 \x03(\t\x12\r\n\x05\x62uild\x18\x03 \x03(\t\x12\x0f\n\x07version\x18\x04 \x01(\t\"\xce\x01\n\x0b\x44\x65viceState\x12\x0e\n\x06\x64\x65vice\x18\x01 \x03(\t\x12\r\n\x05\x62uild\x18\x02 \x03(\t\x12\x19\n\x11\x62uild_incremental\x18\x03 \x01(\t\x12\x11\n\ttimestamp\x18\x04 \x01(\x03\x12\x11\n\tsdk_level\x18\x05 \x01(\t\x12\x1c\n\x14security_patch_level\x18\x06 \x01(\t\x12\x41\n\x0fpartition_state\x18\x07 \x03(\x0b\x32(.build.tools.releasetools.PartitionState\"c\n\x08\x41pexInfo\x12\x14\n\x0cpackage_name\x18\x01 \x01(\t\x12\x0f\n\x07version\x18\x02 \x01(\x03\x12\x15\n\ris_compressed\x18\x03 \x01(\x08\x12\x19\n\x11\x64\x65\x63ompressed_size\x18\x04 \x01(\x03\"E\n\x0c\x41pexMetadata\x12\x35\n\tapex_info\x18\x01 \x03(\x0b\x32\".build.tools.releasetools.ApexInfo\"\xf8\x03\n\x0bOtaMetadata\x12;\n\x04type\x18\x01 \x01(\x0e\x32-.build.tools.releasetools.OtaMetadata.OtaType\x12\x0c\n\x04wipe\x18\x02 \x01(\x08\x12\x11\n\tdowngrade\x18\x03 \x01(\x08\x12P\n\x0eproperty_files\x18\x04 \x03(\x0b\x32\x38.build.tools.releasetools.OtaMetadata.PropertyFilesEntry\x12;\n\x0cprecondition\x18\x05 \x01(\x0b\x32%.build.tools.releasetools.DeviceState\x12<\n\rpostcondition\x18\x06 \x01(\x0b\x32%.build.tools.releasetools.DeviceState\x12#\n\x1bretrofit_dynamic_partitions\x18\x07 \x01(\x08\x12\x16\n\x0erequired_cache\x18\x08 \x01(\x03\x12\x15\n\rspl_downgrade\x18\t \x01(\x08\x1a\x34\n\x12PropertyFilesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"4\n\x07OtaType\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x06\n\x02\x41\x42\x10\x01\x12\t\n\x05\x42LOCK\x10\x02\x12\t\n\x05\x42RICK\x10\x03\x42\x02H\x03\x62\x06proto3')
+  serialized_options=_b('\n\013android.otaB\022OtaPackageMetadataH\003'),
+  serialized_pb=_b('\n\x12ota_metadata.proto\x12\x18\x62uild.tools.releasetools\"X\n\x0ePartitionState\x12\x16\n\x0epartition_name\x18\x01 \x01(\t\x12\x0e\n\x06\x64\x65vice\x18\x02 \x03(\t\x12\r\n\x05\x62uild\x18\x03 \x03(\t\x12\x0f\n\x07version\x18\x04 \x01(\t\"\xce\x01\n\x0b\x44\x65viceState\x12\x0e\n\x06\x64\x65vice\x18\x01 \x03(\t\x12\r\n\x05\x62uild\x18\x02 \x03(\t\x12\x19\n\x11\x62uild_incremental\x18\x03 \x01(\t\x12\x11\n\ttimestamp\x18\x04 \x01(\x03\x12\x11\n\tsdk_level\x18\x05 \x01(\t\x12\x1c\n\x14security_patch_level\x18\x06 \x01(\t\x12\x41\n\x0fpartition_state\x18\x07 \x03(\x0b\x32(.build.tools.releasetools.PartitionState\"{\n\x08\x41pexInfo\x12\x14\n\x0cpackage_name\x18\x01 \x01(\t\x12\x0f\n\x07version\x18\x02 \x01(\x03\x12\x15\n\ris_compressed\x18\x03 \x01(\x08\x12\x19\n\x11\x64\x65\x63ompressed_size\x18\x04 \x01(\x03\x12\x16\n\x0esource_version\x18\x05 \x01(\x03\"E\n\x0c\x41pexMetadata\x12\x35\n\tapex_info\x18\x01 \x03(\x0b\x32\".build.tools.releasetools.ApexInfo\"\xf8\x03\n\x0bOtaMetadata\x12;\n\x04type\x18\x01 \x01(\x0e\x32-.build.tools.releasetools.OtaMetadata.OtaType\x12\x0c\n\x04wipe\x18\x02 \x01(\x08\x12\x11\n\tdowngrade\x18\x03 \x01(\x08\x12P\n\x0eproperty_files\x18\x04 \x03(\x0b\x32\x38.build.tools.releasetools.OtaMetadata.PropertyFilesEntry\x12;\n\x0cprecondition\x18\x05 \x01(\x0b\x32%.build.tools.releasetools.DeviceState\x12<\n\rpostcondition\x18\x06 \x01(\x0b\x32%.build.tools.releasetools.DeviceState\x12#\n\x1bretrofit_dynamic_partitions\x18\x07 \x01(\x08\x12\x16\n\x0erequired_cache\x18\x08 \x01(\x03\x12\x15\n\rspl_downgrade\x18\t \x01(\x08\x1a\x34\n\x12PropertyFilesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"4\n\x07OtaType\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x06\n\x02\x41\x42\x10\x01\x12\t\n\x05\x42LOCK\x10\x02\x12\t\n\x05\x42RICK\x10\x03\x42#\n\x0b\x61ndroid.otaB\x12OtaPackageMetadataH\x03\x62\x06proto3')
 )
 
 
@@ -50,8 +50,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=972,
-  serialized_end=1024,
+  serialized_start=996,
+  serialized_end=1048,
 )
 _sym_db.RegisterEnumDescriptor(_OTAMETADATA_OTATYPE)
 
@@ -216,6 +216,13 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='source_version', full_name='build.tools.releasetools.ApexInfo.source_version', index=4,
+      number=5, type=3, cpp_type=2, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR),
   ],
   extensions=[
   ],
@@ -229,7 +236,7 @@
   oneofs=[
   ],
   serialized_start=347,
-  serialized_end=446,
+  serialized_end=470,
 )
 
 
@@ -259,8 +266,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=448,
-  serialized_end=517,
+  serialized_start=472,
+  serialized_end=541,
 )
 
 
@@ -297,8 +304,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=918,
-  serialized_end=970,
+  serialized_start=942,
+  serialized_end=994,
 )
 
 _OTAMETADATA = _descriptor.Descriptor(
@@ -384,8 +391,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=520,
-  serialized_end=1024,
+  serialized_start=544,
+  serialized_end=1048,
 )
 
 _DEVICESTATE.fields_by_name['partition_state'].message_type = _PARTITIONSTATE
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 9b5bcab..d3fbdad 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -1234,6 +1234,7 @@
   vendor_misc_info["avb_building_vbmeta_image"] = "false" # skip building vbmeta
   vendor_misc_info["use_dynamic_partitions"] = "false"  # super_empty
   vendor_misc_info["build_super_partition"] = "false"  # super split
+  vendor_misc_info["avb_vbmeta_system"] = ""  # skip building vbmeta_system
   with open(vendor_misc_info_path, "w") as output:
     for key in sorted(vendor_misc_info):
       output.write("{}={}\n".format(key, vendor_misc_info[key]))