Merge "Allowlist tools that apexer uses"
diff --git a/android/filegroup.go b/android/filegroup.go
index 485e0b9..14ed783 100644
--- a/android/filegroup.go
+++ b/android/filegroup.go
@@ -116,6 +116,23 @@
 	return module
 }
 
+var _ blueprint.JSONActionSupplier = (*fileGroup)(nil)
+
+func (fg *fileGroup) JSONActions() []blueprint.JSONAction {
+	ins := make([]string, 0, len(fg.srcs))
+	outs := make([]string, 0, len(fg.srcs))
+	for _, p := range fg.srcs {
+		ins = append(ins, p.String())
+		outs = append(outs, p.Rel())
+	}
+	return []blueprint.JSONAction{
+		blueprint.JSONAction{
+			Inputs:  ins,
+			Outputs: outs,
+		},
+	}
+}
+
 func (fg *fileGroup) GenerateAndroidBuildActions(ctx ModuleContext) {
 	fg.srcs = PathsForModuleSrcExcludes(ctx, fg.properties.Srcs, fg.properties.Exclude_srcs)
 	if fg.properties.Path != nil {
diff --git a/bazel/aquery.go b/bazel/aquery.go
index b09bc09..3affcb0 100644
--- a/bazel/aquery.go
+++ b/bazel/aquery.go
@@ -391,10 +391,10 @@
 	return fullHash
 }
 
-func (aqueryHandler *aqueryArtifactHandler) depsetContentHashes(inputDepsetIds []int) ([]string, error) {
+func (a *aqueryArtifactHandler) depsetContentHashes(inputDepsetIds []int) ([]string, error) {
 	hashes := []string{}
 	for _, depsetId := range inputDepsetIds {
-		if aqueryDepset, exists := aqueryHandler.depsetIdToAqueryDepset[depsetId]; !exists {
+		if aqueryDepset, exists := a.depsetIdToAqueryDepset[depsetId]; !exists {
 			return nil, fmt.Errorf("undefined input depsetId %d", depsetId)
 		} else {
 			hashes = append(hashes, aqueryDepset.ContentHash)
@@ -403,13 +403,13 @@
 	return hashes, nil
 }
 
-func (aqueryHandler *aqueryArtifactHandler) normalActionBuildStatement(actionEntry action) (BuildStatement, error) {
+func (a *aqueryArtifactHandler) normalActionBuildStatement(actionEntry action) (BuildStatement, error) {
 	command := strings.Join(proptools.ShellEscapeListIncludingSpaces(actionEntry.Arguments), " ")
-	inputDepsetHashes, err := aqueryHandler.depsetContentHashes(actionEntry.InputDepSetIds)
+	inputDepsetHashes, err := a.depsetContentHashes(actionEntry.InputDepSetIds)
 	if err != nil {
 		return BuildStatement{}, err
 	}
-	outputPaths, depfile, err := aqueryHandler.getOutputPaths(actionEntry)
+	outputPaths, depfile, err := a.getOutputPaths(actionEntry)
 	if err != nil {
 		return BuildStatement{}, err
 	}
@@ -425,12 +425,12 @@
 	return buildStatement, nil
 }
 
-func (aqueryHandler *aqueryArtifactHandler) pythonZipperActionBuildStatement(actionEntry action, prevBuildStatements []BuildStatement) (BuildStatement, error) {
-	inputPaths, err := aqueryHandler.getInputPaths(actionEntry.InputDepSetIds)
+func (a *aqueryArtifactHandler) pythonZipperActionBuildStatement(actionEntry action, prevBuildStatements []BuildStatement) (BuildStatement, error) {
+	inputPaths, err := a.getInputPaths(actionEntry.InputDepSetIds)
 	if err != nil {
 		return BuildStatement{}, err
 	}
-	outputPaths, depfile, err := aqueryHandler.getOutputPaths(actionEntry)
+	outputPaths, depfile, err := a.getOutputPaths(actionEntry)
 	if err != nil {
 		return BuildStatement{}, err
 	}
@@ -473,8 +473,8 @@
 	return buildStatement, nil
 }
 
-func (aqueryHandler *aqueryArtifactHandler) templateExpandActionBuildStatement(actionEntry action) (BuildStatement, error) {
-	outputPaths, depfile, err := aqueryHandler.getOutputPaths(actionEntry)
+func (a *aqueryArtifactHandler) templateExpandActionBuildStatement(actionEntry action) (BuildStatement, error) {
+	outputPaths, depfile, err := a.getOutputPaths(actionEntry)
 	if err != nil {
 		return BuildStatement{}, err
 	}
@@ -489,7 +489,7 @@
 	// See go/python-binary-host-mixed-build for more details.
 	command := fmt.Sprintf(`/bin/bash -c 'echo "%[1]s" | sed "s/\\\\n/\\n/g" > %[2]s && chmod a+x %[2]s'`,
 		escapeCommandlineArgument(expandedTemplateContent), outputPaths[0])
-	inputDepsetHashes, err := aqueryHandler.depsetContentHashes(actionEntry.InputDepSetIds)
+	inputDepsetHashes, err := a.depsetContentHashes(actionEntry.InputDepSetIds)
 	if err != nil {
 		return BuildStatement{}, err
 	}
@@ -505,13 +505,13 @@
 	return buildStatement, nil
 }
 
-func (aqueryHandler *aqueryArtifactHandler) symlinkActionBuildStatement(actionEntry action) (BuildStatement, error) {
-	outputPaths, depfile, err := aqueryHandler.getOutputPaths(actionEntry)
+func (a *aqueryArtifactHandler) symlinkActionBuildStatement(actionEntry action) (BuildStatement, error) {
+	outputPaths, depfile, err := a.getOutputPaths(actionEntry)
 	if err != nil {
 		return BuildStatement{}, err
 	}
 
-	inputPaths, err := aqueryHandler.getInputPaths(actionEntry.InputDepSetIds)
+	inputPaths, err := a.getInputPaths(actionEntry.InputDepSetIds)
 	if err != nil {
 		return BuildStatement{}, err
 	}
@@ -538,9 +538,9 @@
 	return buildStatement, nil
 }
 
-func (aqueryHandler *aqueryArtifactHandler) getOutputPaths(actionEntry action) (outputPaths []string, depfile *string, err error) {
+func (a *aqueryArtifactHandler) getOutputPaths(actionEntry action) (outputPaths []string, depfile *string, err error) {
 	for _, outputId := range actionEntry.OutputIds {
-		outputPath, exists := aqueryHandler.artifactIdToPath[outputId]
+		outputPath, exists := a.artifactIdToPath[outputId]
 		if !exists {
 			err = fmt.Errorf("undefined outputId %d", outputId)
 			return
diff --git a/java/droidstubs.go b/java/droidstubs.go
index 115388b..932fb19 100644
--- a/java/droidstubs.go
+++ b/java/droidstubs.go
@@ -697,87 +697,16 @@
 
 	zipSyncCleanupCmd(rule, srcJarDir)
 
-	rule.Build("metalava", "metalava merged")
-
 	if apiCheckEnabled(ctx, d.properties.Check_api.Current, "current") {
+		d.generateCheckCurrentCheckedInApiIsUpToDateBuildRules(ctx)
 
-		if len(d.Javadoc.properties.Out) > 0 {
-			ctx.PropertyErrorf("out", "out property may not be combined with check_api")
-		}
-
-		apiFile := android.PathForModuleSrc(ctx, String(d.properties.Check_api.Current.Api_file))
-		removedApiFile := android.PathForModuleSrc(ctx, String(d.properties.Check_api.Current.Removed_api_file))
-		baselineFile := android.OptionalPathForModuleSrc(ctx, d.properties.Check_api.Current.Baseline_file)
-
-		if baselineFile.Valid() {
-			ctx.PropertyErrorf("baseline_file", "current API check can't have a baseline file. (module %s)", ctx.ModuleName())
-		}
-
-		d.checkCurrentApiTimestamp = android.PathForModuleOut(ctx, "metalava", "check_current_api.timestamp")
-
-		rule := android.NewRuleBuilder(pctx, ctx)
-
-		// Diff command line.
-		// -F matches the closest "opening" line, such as "package android {"
-		// and "  public class Intent {".
-		diff := `diff -u -F '{ *$'`
-
-		rule.Command().Text("( true")
-		rule.Command().
-			Text(diff).
-			Input(apiFile).Input(d.apiFile)
-
-		rule.Command().
-			Text(diff).
-			Input(removedApiFile).Input(d.removedApiFile)
-
-		msg := fmt.Sprintf(`\n******************************\n`+
-			`You have tried to change the API from what has been previously approved.\n\n`+
-			`To make these errors go away, you have two choices:\n`+
-			`   1. You can add '@hide' javadoc comments (and remove @SystemApi/@TestApi/etc)\n`+
-			`      to the new methods, etc. shown in the above diff.\n\n`+
-			`   2. You can update current.txt and/or removed.txt by executing the following command:\n`+
-			`         m %s-update-current-api\n\n`+
-			`      To submit the revised current.txt to the main Android repository,\n`+
-			`      you will need approval.\n`+
-			`******************************\n`, ctx.ModuleName())
-
-		rule.Command().
-			Text("touch").Output(d.checkCurrentApiTimestamp).
-			Text(") || (").
-			Text("echo").Flag("-e").Flag(`"` + msg + `"`).
-			Text("; exit 38").
-			Text(")")
-
-		rule.Build("metalavaCurrentApiCheck", "check current API")
-
-		d.updateCurrentApiTimestamp = android.PathForModuleOut(ctx, "metalava", "update_current_api.timestamp")
-
-		// update API rule
-		rule = android.NewRuleBuilder(pctx, ctx)
-
-		rule.Command().Text("( true")
-
-		rule.Command().
-			Text("cp").Flag("-f").
-			Input(d.apiFile).Flag(apiFile.String())
-
-		rule.Command().
-			Text("cp").Flag("-f").
-			Input(d.removedApiFile).Flag(removedApiFile.String())
-
-		msg = "failed to update public API"
-
-		rule.Command().
-			Text("touch").Output(d.updateCurrentApiTimestamp).
-			Text(") || (").
-			Text("echo").Flag("-e").Flag(`"` + msg + `"`).
-			Text("; exit 38").
-			Text(")")
-
-		rule.Build("metalavaCurrentApiUpdate", "update current API")
+		// Make sure that whenever the API stubs are generated that the current checked in API files are
+		// checked to make sure that they are up-to-date.
+		cmd.Validation(d.checkCurrentApiTimestamp)
 	}
 
+	rule.Build("metalava", "metalava merged")
+
 	if String(d.properties.Check_nullability_warnings) != "" {
 		if d.nullabilityWarningsFile == nil {
 			ctx.PropertyErrorf("check_nullability_warnings",
@@ -814,6 +743,84 @@
 	}
 }
 
+func (d *Droidstubs) generateCheckCurrentCheckedInApiIsUpToDateBuildRules(ctx android.ModuleContext) {
+	if len(d.Javadoc.properties.Out) > 0 {
+		ctx.PropertyErrorf("out", "out property may not be combined with check_api")
+	}
+
+	apiFile := android.PathForModuleSrc(ctx, String(d.properties.Check_api.Current.Api_file))
+	removedApiFile := android.PathForModuleSrc(ctx, String(d.properties.Check_api.Current.Removed_api_file))
+	baselineFile := android.OptionalPathForModuleSrc(ctx, d.properties.Check_api.Current.Baseline_file)
+
+	if baselineFile.Valid() {
+		ctx.PropertyErrorf("baseline_file", "current API check can't have a baseline file. (module %s)", ctx.ModuleName())
+	}
+
+	d.checkCurrentApiTimestamp = android.PathForModuleOut(ctx, "metalava", "check_current_api.timestamp")
+
+	rule := android.NewRuleBuilder(pctx, ctx)
+
+	// Diff command line.
+	// -F matches the closest "opening" line, such as "package android {"
+	// and "  public class Intent {".
+	diff := `diff -u -F '{ *$'`
+
+	rule.Command().Text("( true")
+	rule.Command().
+		Text(diff).
+		Input(apiFile).Input(d.apiFile)
+
+	rule.Command().
+		Text(diff).
+		Input(removedApiFile).Input(d.removedApiFile)
+
+	msg := fmt.Sprintf(`\n******************************\n`+
+		`You have tried to change the API from what has been previously approved.\n\n`+
+		`To make these errors go away, you have two choices:\n`+
+		`   1. You can add '@hide' javadoc comments (and remove @SystemApi/@TestApi/etc)\n`+
+		`      to the new methods, etc. shown in the above diff.\n\n`+
+		`   2. You can update current.txt and/or removed.txt by executing the following command:\n`+
+		`         m %s-update-current-api\n\n`+
+		`      To submit the revised current.txt to the main Android repository,\n`+
+		`      you will need approval.\n`+
+		`******************************\n`, ctx.ModuleName())
+
+	rule.Command().
+		Text("touch").Output(d.checkCurrentApiTimestamp).
+		Text(") || (").
+		Text("echo").Flag("-e").Flag(`"` + msg + `"`).
+		Text("; exit 38").
+		Text(")")
+
+	rule.Build("metalavaCurrentApiCheck", "check current API")
+
+	d.updateCurrentApiTimestamp = android.PathForModuleOut(ctx, "metalava", "update_current_api.timestamp")
+
+	// update API rule
+	rule = android.NewRuleBuilder(pctx, ctx)
+
+	rule.Command().Text("( true")
+
+	rule.Command().
+		Text("cp").Flag("-f").
+		Input(d.apiFile).Flag(apiFile.String())
+
+	rule.Command().
+		Text("cp").Flag("-f").
+		Input(d.removedApiFile).Flag(removedApiFile.String())
+
+	msg = "failed to update public API"
+
+	rule.Command().
+		Text("touch").Output(d.updateCurrentApiTimestamp).
+		Text(") || (").
+		Text("echo").Flag("-e").Flag(`"` + msg + `"`).
+		Text("; exit 38").
+		Text(")")
+
+	rule.Build("metalavaCurrentApiUpdate", "update current API")
+}
+
 func StubsDefaultsFactory() android.Module {
 	module := &DocDefaults{}
 
diff --git a/rust/config/allowed_list.go b/rust/config/allowed_list.go
index 817e121..9129b0e 100644
--- a/rust/config/allowed_list.go
+++ b/rust/config/allowed_list.go
@@ -30,6 +30,7 @@
 		"system/core/debuggerd/rust",
 		"system/core/libstats/pull_rust",
 		"system/core/trusty/libtrusty-rs",
+		"system/core/trusty/keymint",
 		"system/extras/profcollectd",
 		"system/extras/simpleperf",
 		"system/hardware/interfaces/keystore2",