Merge "rustc-1.80.1 Build 12274397" into main
diff --git a/android/Android.bp b/android/Android.bp
index 96e8133..78eca11 100644
--- a/android/Android.bp
+++ b/android/Android.bp
@@ -41,6 +41,7 @@
         "build_prop.go",
         "compliance_metadata.go",
         "config.go",
+        "container_violations.go",
         "container.go",
         "test_config.go",
         "configurable_properties.go",
diff --git a/android/androidmk.go b/android/androidmk.go
index f6f4889..0d196b6 100644
--- a/android/androidmk.go
+++ b/android/androidmk.go
@@ -157,6 +157,7 @@
 }
 
 type AndroidMkEntriesContext interface {
+	OtherModuleProviderContext
 	Config() Config
 }
 
@@ -354,14 +355,15 @@
 		availableTaggedDists = availableTaggedDists.addPathsForTag(DefaultDistTag, a.OutputFile.Path())
 	}
 
+	info := OtherModuleProviderOrDefault(a.entryContext, mod, InstallFilesProvider)
 	// If the distFiles created by GenerateTaggedDistFiles contains paths for the
 	// DefaultDistTag then that takes priority so delete any existing paths.
-	if _, ok := amod.distFiles[DefaultDistTag]; ok {
+	if _, ok := info.DistFiles[DefaultDistTag]; ok {
 		delete(availableTaggedDists, DefaultDistTag)
 	}
 
 	// Finally, merge the distFiles created by GenerateTaggedDistFiles.
-	availableTaggedDists = availableTaggedDists.merge(amod.distFiles)
+	availableTaggedDists = availableTaggedDists.merge(info.DistFiles)
 
 	if len(availableTaggedDists) == 0 {
 		// Nothing dist-able for this module.
@@ -372,7 +374,7 @@
 	distContributions := &distContributions{}
 
 	if !exemptFromRequiredApplicableLicensesProperty(mod.(Module)) {
-		distContributions.licenseMetadataFile = amod.licenseMetadataFile
+		distContributions.licenseMetadataFile = info.LicenseMetadataFile
 	}
 
 	// Iterate over this module's dist structs, merged from the dist and dists properties.
@@ -910,7 +912,6 @@
 		case "*phony.PhonyRule": // writes phony deps and acts like `.PHONY`
 		case "*selinux.selinuxContextsModule": // license properties written
 		case "*sysprop.syspropLibrary": // license properties written
-		case "*vintf.vintfCompatibilityMatrixRule": // use case like phony
 		default:
 			if !ctx.Config().IsEnvFalse("ANDROID_REQUIRE_LICENSES") {
 				return fmt.Errorf("custom make rules not allowed for %q (%q) module %q", ctx.ModuleType(mod), reflect.TypeOf(mod), ctx.ModuleName(mod))
diff --git a/android/androidmk_test.go b/android/androidmk_test.go
index 72b8654..c37eeab 100644
--- a/android/androidmk_test.go
+++ b/android/androidmk_test.go
@@ -46,7 +46,6 @@
 
 func (m *customModule) GenerateAndroidBuildActions(ctx ModuleContext) {
 
-	m.base().licenseMetadataFile = PathForOutput(ctx, "meta_lic")
 	var defaultDistPaths Paths
 
 	// If the dist_output_file: true then create an output file that is stored in
@@ -276,7 +275,8 @@
 		)
 	}
 	for idx, line := range androidMkLines {
-		expectedLine := strings.ReplaceAll(expectedAndroidMkLines[idx], "meta_lic", module.base().licenseMetadataFile.String())
+		expectedLine := strings.ReplaceAll(expectedAndroidMkLines[idx], "meta_lic",
+			OtherModuleProviderOrDefault(ctx, module, InstallFilesProvider).LicenseMetadataFile.String())
 		if line != expectedLine {
 			t.Errorf(
 				"Expected AndroidMk line to be '%s', got '%s'",
diff --git a/android/config.go b/android/config.go
index 77c5b34..2f6ade7 100644
--- a/android/config.go
+++ b/android/config.go
@@ -2060,19 +2060,3 @@
 func (c *config) EnableUffdGc() string {
 	return String(c.productVariables.EnableUffdGc)
 }
-
-func (c *config) DeviceFrameworkCompatibilityMatrixFile() []string {
-	return c.productVariables.DeviceFrameworkCompatibilityMatrixFile
-}
-
-func (c *config) DeviceProductCompatibilityMatrixFile() []string {
-	return c.productVariables.DeviceProductCompatibilityMatrixFile
-}
-
-func (c *config) BoardAvbEnable() bool {
-	return Bool(c.productVariables.BoardAvbEnable)
-}
-
-func (c *config) BoardAvbSystemAddHashtreeFooterArgs() []string {
-	return c.productVariables.BoardAvbSystemAddHashtreeFooterArgs
-}
diff --git a/android/container_violations.go b/android/container_violations.go
new file mode 100644
index 0000000..14cd61b
--- /dev/null
+++ b/android/container_violations.go
@@ -0,0 +1,1038 @@
+// Copyright 2024 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package android
+
+var ContainerDependencyViolationAllowlist = map[string][]string{
+	"android.car-module.impl": {
+		"modules-utils-preconditions", // apex [com.android.car.framework] -> apex [com.android.adservices, com.android.appsearch, com.android.cellbroadcast, com.android.extservices, com.android.ondevicepersonalization, com.android.tethering, com.android.uwb, com.android.wifi, test_com.android.cellbroadcast, test_com.android.wifi]
+	},
+
+	"AppInstalledOnMultipleUsers": {
+		"framework", // cts -> unstable
+	},
+
+	"art-aconfig-flags-java-lib": {
+		"framework-api-annotations-lib", // apex [com.android.art, com.android.art.debug, com.android.art.testing, test_imgdiag_com.android.art, test_jitzygote_com.android.art] -> system
+	},
+
+	"Bluetooth": {
+		"app-compat-annotations",         // apex [com.android.btservices] -> system
+		"framework-bluetooth-pre-jarjar", // apex [com.android.btservices] -> system
+	},
+
+	"bluetooth-nano-protos": {
+		"libprotobuf-java-nano", // apex [com.android.btservices] -> apex [com.android.wifi, test_com.android.wifi]
+	},
+
+	"bluetooth.change-ids": {
+		"app-compat-annotations", // apex [com.android.btservices] -> system
+	},
+
+	"CarServiceUpdatable": {
+		"modules-utils-os",                    // apex [com.android.car.framework] -> apex [com.android.permission, test_com.android.permission]
+		"modules-utils-preconditions",         // apex [com.android.car.framework] -> apex [com.android.adservices, com.android.appsearch, com.android.cellbroadcast, com.android.extservices, com.android.ondevicepersonalization, com.android.tethering, com.android.uwb, com.android.wifi, test_com.android.cellbroadcast, test_com.android.wifi]
+		"modules-utils-shell-command-handler", // apex [com.android.car.framework] -> apex [com.android.adservices, com.android.art, com.android.art.debug, com.android.art.testing, com.android.btservices, com.android.configinfrastructure, com.android.mediaprovider, com.android.nfcservices, com.android.permission, com.android.scheduling, com.android.tethering, com.android.uwb, com.android.wifi, test_com.android.mediaprovider, test_com.android.permission, test_com.android.wifi, test_imgdiag_com.android.art, test_jitzygote_com.android.art]
+	},
+
+	"connectivity-net-module-utils-bpf": {
+		"net-utils-device-common-struct-base", // apex [com.android.tethering] -> system
+	},
+
+	"conscrypt-aconfig-flags-lib": {
+		"aconfig-annotations-lib-sdk-none", // apex [com.android.conscrypt, test_com.android.conscrypt] -> system
+	},
+
+	"cronet_aml_base_base_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+		"jsr305", // apex [com.android.tethering] -> apex [com.android.adservices, com.android.devicelock, com.android.extservices, com.android.healthfitness, com.android.media, com.android.mediaprovider, test_com.android.media, test_com.android.mediaprovider]
+	},
+
+	"cronet_aml_build_android_build_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_base_feature_overrides_java_proto": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_cronet_api_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_cronet_impl_common_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_cronet_impl_native_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+		"jsr305", // apex [com.android.tethering] -> apex [com.android.adservices, com.android.devicelock, com.android.extservices, com.android.healthfitness, com.android.media, com.android.mediaprovider, test_com.android.media, test_com.android.mediaprovider]
+	},
+
+	"cronet_aml_components_cronet_android_cronet_jni_registration_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_cronet_shared_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_cronet_stats_log_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_cronet_urlconnection_impl_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_flags_java_proto": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_components_cronet_android_request_context_config_java_proto": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_net_android_net_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+		"jsr305", // apex [com.android.tethering] -> apex [com.android.adservices, com.android.devicelock, com.android.extservices, com.android.healthfitness, com.android.media, com.android.mediaprovider, test_com.android.media, test_com.android.mediaprovider]
+	},
+
+	"cronet_aml_net_android_net_thread_stats_uid_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_third_party_jni_zero_jni_zero_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"cronet_aml_url_url_java": {
+		"framework-connectivity-pre-jarjar-without-cronet", // apex [com.android.tethering] -> system
+	},
+
+	"CtsAdservicesHostTestApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAdServicesNotInAllowListEndToEndTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAdServicesPermissionsAppOptOutEndToEndTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAdServicesPermissionsNoPermEndToEndTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAdServicesPermissionsValidEndToEndTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAlarmManagerTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAndroidAppTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAppExitTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAppFgsStartTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAppFgsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAppOpsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAppSearchTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAppTestStubsApp2": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsAudioHostTestApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsBackgroundActivityAppAllowCrossUidFlagDefault": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsBatterySavingTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsBluetoothTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsBootDisplayModeApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsBroadcastTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsBRSTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCompanionDeviceManagerCoreTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCompanionDeviceManagerMultiProcessTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCompanionDeviceManagerUiAutomationTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsContentSuggestionsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsContentTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCredentialManagerBackupRestoreApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCrossProfileEnabledApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCrossProfileEnabledNoPermsApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCrossProfileNotEnabledApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsCrossProfileUserEnabledApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDeviceAndProfileOwnerApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDeviceAndProfileOwnerApp23": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDeviceAndProfileOwnerApp25": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDeviceAndProfileOwnerApp30": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDeviceLockTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDeviceOwnerApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDevicePolicySimTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDevicePolicyTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDreamsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsDrmTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsEphemeralTestsEphemeralApp1": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsFgsBootCompletedTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsFgsBootCompletedTestCasesApi35": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsFgsStartTestHelperApi34": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsFgsStartTestHelperCurrent": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsFileDescriptorTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsHostsideCompatChangeTestsApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsHostsideNetworkPolicyTestsApp2": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsIdentityTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsIkeTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsInstalledLoadingProgressDeviceTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsInstantAppTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsIntentSenderApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsJobSchedulerTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsKeystoreTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsLegacyNotification27TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsLibcoreTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsLibcoreWycheproofConscryptTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsListeningPortsTest": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsLocationCoarseTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsLocationFineTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsLocationNoneTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsLocationPrivilegedTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsManagedProfileApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaAudioTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaBetterTogetherTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaCodecTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaDecoderTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaDrmFrameworkTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaEncoderTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaExtractorTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaMiscTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaMuxerTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaPerformanceClassTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaPlayerTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaProjectionSDK33TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaProjectionSDK34TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaProjectionTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaProviderTranscodeTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaRecorderTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaRouterHostSideTestBluetoothPermissionsApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaRouterHostSideTestMediaRoutingControlApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaRouterHostSideTestModifyAudioRoutingApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMediaV2TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMimeMapTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsModifyQuietModeEnabledApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsMusicRecognitionTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNativeMediaAAudioTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNetTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNetTestCasesLegacyApi22": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNetTestCasesMaxTargetSdk30": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNetTestCasesMaxTargetSdk31": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNetTestCasesMaxTargetSdk33": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNetTestCasesUpdateStatsPermission": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsNfcTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsOnDevicePersonalizationTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsPackageInstallerApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsPackageManagerTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsPackageSchemeTestsWithoutVisibility": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsPackageSchemeTestsWithVisibility": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsPermissionsSyncTestApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsPreservedSettingsApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsProtoTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsProviderTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsProxyMediaRouterTestHelperApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsRebootReadinessTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsResourcesLoaderTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsResourcesTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSandboxedAdIdManagerTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSandboxedAppSetIdManagerTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSandboxedFledgeManagerTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSandboxedMeasurementManagerTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSandboxedTopicsManagerTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSdkExtensionsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSdkSandboxInprocessTests": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSecureElementTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSecurityTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSelinuxEphemeralTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSelinuxTargetSdk25TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSelinuxTargetSdk27TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSelinuxTargetSdk28TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSelinuxTargetSdk29TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSelinuxTargetSdk30TestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSelinuxTargetSdkCurrentTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSettingsDeviceOwnerApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSharedUserMigrationTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsShortFgsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSimRestrictedApisTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSliceTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSpeechTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsStatsSecurityApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSuspendAppsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsSystemUiTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsTareTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsTelephonyTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsTetheringTest": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsThreadNetworkTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsUsageStatsTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsUsbManagerTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsUserRestrictionTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsUtilTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsUwbTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVcnTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVideoCodecTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVideoTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsViewReceiveContentTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVirtualDevicesAppLaunchTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVirtualDevicesAudioTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVirtualDevicesCameraTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVirtualDevicesSensorTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsVirtualDevicesTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWearableSensingServiceTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWebViewCompatChangeApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWidgetTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWidgetTestCases29": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWifiNonUpdatableTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWifiTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWindowManagerExternalApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsWindowManagerTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"CtsZipValidateApp": {
+		"framework", // cts -> unstable
+	},
+
+	"CVE-2021-0965": {
+		"framework", // cts -> unstable
+	},
+
+	"device_config_reboot_flags_java_lib": {
+		"ext",       // apex [com.android.configinfrastructure] -> system
+		"framework", // apex [com.android.configinfrastructure] -> system
+	},
+
+	"devicelockcontroller-lib": {
+		"modules-utils-expresslog", // apex [com.android.devicelock] -> apex [com.android.btservices, com.android.car.framework]
+	},
+
+	"FederatedCompute": {
+		"auto_value_annotations", // apex [com.android.ondevicepersonalization] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"framework-adservices.impl": {
+		"adservices_flags_lib", // apex [com.android.adservices, com.android.extservices] -> system
+	},
+
+	"framework-bluetooth.impl": {
+		"app-compat-annotations", // apex [com.android.btservices] -> system
+	},
+
+	"framework-connectivity-t.impl": {
+		"app-compat-annotations",            // apex [com.android.tethering] -> system
+		"framework-connectivity-pre-jarjar", // apex [com.android.tethering] -> system
+	},
+
+	"framework-connectivity.impl": {
+		"app-compat-annotations", // apex [com.android.tethering] -> system
+	},
+
+	"framework-ondevicepersonalization.impl": {
+		"ondevicepersonalization_flags_lib", // apex [com.android.ondevicepersonalization] -> system
+	},
+
+	"framework-pdf.impl": {
+		"modules-utils-preconditions", // apex [com.android.mediaprovider, test_com.android.mediaprovider] -> apex [com.android.adservices, com.android.appsearch, com.android.cellbroadcast, com.android.extservices, com.android.ondevicepersonalization, com.android.tethering, com.android.uwb, com.android.wifi, test_com.android.cellbroadcast, test_com.android.wifi]
+	},
+
+	"framework-permission-s.impl": {
+		"app-compat-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"framework-wifi.impl": {
+		"aconfig_storage_reader_java", // apex [com.android.wifi, test_com.android.wifi] -> system
+		"app-compat-annotations",      // apex [com.android.wifi, test_com.android.wifi] -> system
+	},
+
+	"grpc-java-core-internal": {
+		"gson",             // apex [com.android.adservices, com.android.devicelock, com.android.extservices] -> apex [com.android.virt]
+		"perfmark-api-lib", // apex [com.android.adservices, com.android.devicelock, com.android.extservices] -> system
+	},
+
+	"httpclient_impl": {
+		"httpclient_api", // apex [com.android.tethering] -> system
+	},
+
+	"IncrementalTestAppValidator": {
+		"framework", // cts -> unstable
+	},
+
+	"libcore-aconfig-flags-lib": {
+		"framework-api-annotations-lib", // apex [com.android.art, com.android.art.debug, com.android.art.testing, test_imgdiag_com.android.art, test_jitzygote_com.android.art] -> system
+	},
+
+	"loadlibrarytest_product_app": {
+		"libnativeloader_vendor_shared_lib", // product -> vendor
+	},
+
+	"loadlibrarytest_testlib": {
+		"libnativeloader_vendor_shared_lib", // system -> vendor
+	},
+
+	"MctsMediaDrmFrameworkTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"MctsMediaTranscodingTestCases": {
+		"framework", // cts -> unstable
+	},
+
+	"MediaProvider": {
+		"app-compat-annotations", // apex [com.android.mediaprovider, test_com.android.mediaprovider] -> system
+	},
+
+	"mediaprovider_flags_java_lib": {
+		"ext",       // apex [com.android.mediaprovider, test_com.android.mediaprovider] -> system
+		"framework", // apex [com.android.mediaprovider, test_com.android.mediaprovider] -> system
+	},
+
+	"MockSatelliteGatewayServiceApp": {
+		"framework", // cts -> unstable
+	},
+
+	"MockSatelliteServiceApp": {
+		"framework", // cts -> unstable
+	},
+
+	"net-utils-device-common-netlink": {
+		"net-utils-device-common-struct-base", // apex [com.android.tethering] -> system
+	},
+
+	"net-utils-device-common-struct": {
+		"net-utils-device-common-struct-base", // apex [com.android.tethering] -> system
+	},
+
+	"okhttp-norepackage": {
+		"okhttp-android-util-log", // apex [com.android.adservices, com.android.devicelock, com.android.extservices] -> system
+	},
+
+	"ondevicepersonalization-plugin-lib": {
+		"auto_value_annotations", // apex [com.android.ondevicepersonalization] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"opencensus-java-api": {
+		"auto_value_annotations", // apex [com.android.devicelock] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"PermissionController-lib": {
+		"safety-center-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"PlatformProperties": {
+		"sysprop-library-stub-platform", // apex [com.android.btservices, com.android.nfcservices, com.android.tethering, com.android.virt, com.android.wifi, test_com.android.wifi] -> system
+	},
+
+	"safety-center-config": {
+		"safety-center-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"safety-center-internal-data": {
+		"safety-center-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"safety-center-pending-intents": {
+		"safety-center-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"safety-center-persistence": {
+		"safety-center-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"safety-center-resources-lib": {
+		"safety-center-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"SdkSandboxManagerDisabledTests": {
+		"framework", // cts -> unstable
+	},
+
+	"SdkSandboxManagerTests": {
+		"framework", // cts -> unstable
+	},
+
+	"service-art.impl": {
+		"auto_value_annotations", // apex [com.android.art, com.android.art.debug, com.android.art.testing, test_imgdiag_com.android.art, test_jitzygote_com.android.art] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"service-bluetooth-pre-jarjar": {
+		"framework-bluetooth-pre-jarjar", // apex [com.android.btservices] -> system
+		"service-bluetooth.change-ids",   // apex [com.android.btservices] -> system
+	},
+
+	"service-connectivity": {
+		"libprotobuf-java-nano", // apex [com.android.tethering] -> apex [com.android.wifi, test_com.android.wifi]
+	},
+
+	"service-connectivity-pre-jarjar": {
+		"framework-connectivity-pre-jarjar", // apex [com.android.tethering] -> system
+	},
+
+	"service-connectivity-protos": {
+		"libprotobuf-java-nano", // apex [com.android.tethering] -> apex [com.android.wifi, test_com.android.wifi]
+	},
+
+	"service-connectivity-tiramisu-pre-jarjar": {
+		"framework-connectivity-pre-jarjar",   // apex [com.android.tethering] -> system
+		"framework-connectivity-t-pre-jarjar", // apex [com.android.tethering] -> system
+	},
+
+	"service-entitlement": {
+		"auto_value_annotations", // apex [com.android.wifi, test_com.android.wifi] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"service-entitlement-api": {
+		"auto_value_annotations", // apex [com.android.wifi, test_com.android.wifi] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"service-entitlement-data": {
+		"auto_value_annotations", // apex [com.android.wifi, test_com.android.wifi] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"service-entitlement-impl": {
+		"auto_value_annotations", // apex [com.android.wifi, test_com.android.wifi] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"service-healthfitness.impl": {
+		"modules-utils-preconditions", // apex [com.android.healthfitness] -> apex [com.android.adservices, com.android.appsearch, com.android.cellbroadcast, com.android.extservices, com.android.ondevicepersonalization, com.android.tethering, com.android.uwb, com.android.wifi, test_com.android.cellbroadcast, test_com.android.wifi]
+	},
+
+	"service-networksecurity-pre-jarjar": {
+		"framework-connectivity-pre-jarjar", // apex [com.android.tethering] -> system
+	},
+
+	"service-permission.impl": {
+		"jsr305",                    // apex [com.android.permission, test_com.android.permission] -> apex [com.android.adservices, com.android.devicelock, com.android.extservices, com.android.healthfitness, com.android.media, com.android.mediaprovider, test_com.android.media, test_com.android.mediaprovider]
+		"safety-center-annotations", // apex [com.android.permission, test_com.android.permission] -> system
+	},
+
+	"service-remoteauth-pre-jarjar": {
+		"framework-connectivity-pre-jarjar",   // apex [com.android.tethering] -> system
+		"framework-connectivity-t-pre-jarjar", // apex [com.android.tethering] -> system
+	},
+
+	"service-thread-pre-jarjar": {
+		"framework-connectivity-pre-jarjar",   // apex [com.android.tethering] -> system
+		"framework-connectivity-t-pre-jarjar", // apex [com.android.tethering] -> system
+	},
+
+	"service-uwb-pre-jarjar": {
+		"framework-uwb-pre-jarjar", // apex [com.android.uwb] -> system
+	},
+
+	"service-wifi": {
+		"auto_value_annotations", // apex [com.android.wifi, test_com.android.wifi] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+	},
+
+	"TelephonyDeviceTest": {
+		"framework", // cts -> unstable
+	},
+
+	"tensorflowlite_java": {
+		"android-support-annotations", // apex [com.android.adservices, com.android.extservices, com.android.ondevicepersonalization] -> system
+	},
+
+	"TestExternalImsServiceApp": {
+		"framework", // cts -> unstable
+	},
+
+	"TestSmsRetrieverApp": {
+		"framework", // cts -> unstable
+	},
+
+	"TetheringApiCurrentLib": {
+		"connectivity-internal-api-util", // apex [com.android.tethering] -> system
+	},
+
+	"TetheringNext": {
+		"connectivity-internal-api-util", // apex [com.android.tethering] -> system
+	},
+
+	"tetheringstatsprotos": {
+		"ext",       // apex [com.android.tethering] -> system
+		"framework", // apex [com.android.tethering] -> system
+	},
+
+	"uwb_aconfig_flags_lib": {
+		"ext",       // apex [com.android.uwb] -> system
+		"framework", // apex [com.android.uwb] -> system
+	},
+
+	"uwb_androidx_backend": {
+		"android-support-annotations", // apex [com.android.tethering] -> system
+	},
+
+	"wifi-service-pre-jarjar": {
+		"app-compat-annotations",    // apex [com.android.wifi, test_com.android.wifi] -> system
+		"auto_value_annotations",    // apex [com.android.wifi, test_com.android.wifi] -> apex [com.android.adservices, com.android.extservices, com.android.extservices_tplus]
+		"framework-wifi-pre-jarjar", // apex [com.android.wifi, test_com.android.wifi] -> system
+		"jsr305",                    // apex [com.android.wifi, test_com.android.wifi] -> apex [com.android.adservices, com.android.devicelock, com.android.extservices, com.android.healthfitness, com.android.media, com.android.mediaprovider, test_com.android.media, test_com.android.mediaprovider]
+	},
+}
diff --git a/android/defaults.go b/android/defaults.go
index c0a2fc6..0d51d9d 100644
--- a/android/defaults.go
+++ b/android/defaults.go
@@ -28,7 +28,7 @@
 var DefaultsDepTag defaultsDependencyTag
 
 type defaultsProperties struct {
-	Defaults proptools.Configurable[[]string]
+	Defaults []string
 }
 
 type DefaultableModuleBase struct {
@@ -278,13 +278,13 @@
 
 func defaultsDepsMutator(ctx BottomUpMutatorContext) {
 	if defaultable, ok := ctx.Module().(Defaultable); ok {
-		ctx.AddDependency(ctx.Module(), DefaultsDepTag, defaultable.defaults().Defaults.GetOrDefault(ctx, nil)...)
+		ctx.AddDependency(ctx.Module(), DefaultsDepTag, defaultable.defaults().Defaults...)
 	}
 }
 
 func defaultsMutator(ctx TopDownMutatorContext) {
 	if defaultable, ok := ctx.Module().(Defaultable); ok {
-		defaults := defaultable.defaults().Defaults.GetOrDefault(ctx, nil)
+		defaults := defaultable.defaults().Defaults
 		if len(defaults) > 0 {
 			var defaultsList []Defaults
 			seen := make(map[Defaults]bool)
@@ -295,7 +295,7 @@
 						if !seen[defaults] {
 							seen[defaults] = true
 							defaultsList = append(defaultsList, defaults)
-							return len(defaults.defaults().Defaults.GetOrDefault(ctx, nil)) > 0
+							return len(defaults.defaults().Defaults) > 0
 						}
 					} else {
 						ctx.PropertyErrorf("defaults", "module %s is not an defaults module",
diff --git a/android/license_metadata.go b/android/license_metadata.go
index cd69749..0ac975f 100644
--- a/android/license_metadata.go
+++ b/android/license_metadata.go
@@ -152,7 +152,7 @@
 
 	// Install map
 	args = append(args,
-		JoinWithPrefix(proptools.NinjaAndShellEscapeListIncludingSpaces(base.licenseInstallMap), "-m "))
+		JoinWithPrefix(proptools.NinjaAndShellEscapeListIncludingSpaces(ctx.licenseInstallMap), "-m "))
 
 	// Built files
 	if len(outputFiles) > 0 {
diff --git a/android/module.go b/android/module.go
index e74af83..0f01f04 100644
--- a/android/module.go
+++ b/android/module.go
@@ -836,16 +836,12 @@
 	primaryLicensesProperty applicableLicensesProperty
 
 	noAddressSanitizer   bool
-	installFilesDepSet   *DepSet[InstallPath]
 	packagingSpecsDepSet *DepSet[PackagingSpec]
 	// katiInitRcInstalls and katiVintfInstalls track the install rules created by Soong that are
 	// allowed to have duplicates across modules and variants.
 	katiInitRcInstalls katiInstalls
 	katiVintfInstalls  katiInstalls
 
-	// The files to copy to the dist as explicitly specified in the .bp file.
-	distFiles TaggedDistFiles
-
 	hooks hooks
 
 	registerProps []interface{}
@@ -864,13 +860,6 @@
 	// Merged Aconfig files for all transitive deps.
 	aconfigFilePaths Paths
 
-	// set of dependency module:location mappings used to populate the license metadata for
-	// apex containers.
-	licenseInstallMap []string
-
-	// The path to the generated license metadata file for the module.
-	licenseMetadataFile WritablePath
-
 	// moduleInfoJSON can be filled out by GenerateAndroidBuildActions to write a JSON file that will
 	// be included in the final module-info.json produced by Make.
 	moduleInfoJSON *ModuleInfoJSON
@@ -1454,12 +1443,13 @@
 		if isInstallDepNeeded(dep, ctx.OtherModuleDependencyTag(dep)) {
 			// Installation is still handled by Make, so anything hidden from Make is not
 			// installable.
+			info := OtherModuleProviderOrDefault(ctx, dep, InstallFilesProvider)
 			if !dep.IsHideFromMake() && !dep.IsSkipInstall() {
-				installDeps = append(installDeps, dep.base().installFilesDepSet)
+				installDeps = append(installDeps, info.TransitiveInstallFiles)
 			}
 			// Add packaging deps even when the dependency is not installed so that uninstallable
 			// modules can still be packaged.  Often the package will be installed instead.
-			packagingSpecs = append(packagingSpecs, dep.base().packagingSpecsDepSet)
+			packagingSpecs = append(packagingSpecs, info.TransitivePackagingSpecs)
 		}
 	})
 
@@ -1606,12 +1596,6 @@
 	return m.base().commonProperties.Compile_multilib
 }
 
-// SetLicenseInstallMap stores the set of dependency module:location mappings for files in an
-// apex container for use when generation the license metadata file.
-func (m *ModuleBase) SetLicenseInstallMap(installMap []string) {
-	m.licenseInstallMap = append(m.licenseInstallMap, installMap...)
-}
-
 func (m *ModuleBase) generateModuleTarget(ctx *moduleContext) {
 	var allInstalledFiles InstallPaths
 	var allCheckbuildFiles Paths
@@ -1778,12 +1762,20 @@
 	PackagingSpecs  []PackagingSpec
 	// katiInstalls tracks the install rules that were created by Soong but are being exported
 	// to Make to convert to ninja rules so that Make can add additional dependencies.
-	KatiInstalls katiInstalls
-	KatiSymlinks katiInstalls
-	TestData     []DataPath
+	KatiInstalls             katiInstalls
+	KatiSymlinks             katiInstalls
+	TestData                 []DataPath
+	TransitivePackagingSpecs *DepSet[PackagingSpec]
+	LicenseMetadataFile      WritablePath
+
+	// The following fields are private before, make it private again once we have
+	// better solution.
+	TransitiveInstallFiles *DepSet[InstallPath]
+	// The files to copy to the dist as explicitly specified in the .bp file.
+	DistFiles TaggedDistFiles
 }
 
-var FinalModuleBuildTargetsProvider = blueprint.NewProvider[FinalModuleBuildTargetsInfo]()
+var InstallFilesProvider = blueprint.NewProvider[InstallFilesInfo]()
 
 type FinalModuleBuildTargetsInfo struct {
 	// Used by buildTargetSingleton to create checkbuild and per-directory build targets
@@ -1793,7 +1785,7 @@
 	BlueprintDir     string
 }
 
-var InstallFilesProvider = blueprint.NewProvider[InstallFilesInfo]()
+var FinalModuleBuildTargetsProvider = blueprint.NewProvider[FinalModuleBuildTargetsInfo]()
 
 func (m *ModuleBase) GenerateBuildActions(blueprintCtx blueprint.ModuleContext) {
 	ctx := &moduleContext{
@@ -1806,13 +1798,13 @@
 
 	setContainerInfo(ctx)
 
-	m.licenseMetadataFile = PathForModuleOut(ctx, "meta_lic")
+	ctx.licenseMetadataFile = PathForModuleOut(ctx, "meta_lic")
 
 	dependencyInstallFiles, dependencyPackagingSpecs := m.computeInstallDeps(ctx)
-	// set m.installFilesDepSet to only the transitive dependencies to be used as the dependencies
+	// set the TransitiveInstallFiles to only the transitive dependencies to be used as the dependencies
 	// of installed files of this module.  It will be replaced by a depset including the installed
 	// files of this module at the end for use by modules that depend on this one.
-	m.installFilesDepSet = NewDepSet[InstallPath](TOPOLOGICAL, nil, dependencyInstallFiles)
+	ctx.TransitiveInstallFiles = NewDepSet[InstallPath](TOPOLOGICAL, nil, dependencyInstallFiles)
 
 	// Temporarily continue to call blueprintCtx.GetMissingDependencies() to maintain the previous behavior of never
 	// reporting missing dependency errors in Blueprint when AllowMissingDependencies == true.
@@ -1856,6 +1848,8 @@
 		checkDistProperties(ctx, fmt.Sprintf("dists[%d]", i), &m.distProperties.Dists[i])
 	}
 
+	var installFiles InstallFilesInfo
+
 	if m.Enabled(ctx) {
 		// ensure all direct android.Module deps are enabled
 		ctx.VisitDirectDepsBlueprint(func(bm blueprint.Module) {
@@ -1972,19 +1966,18 @@
 		// as GenerateTaggedDistFiles() calls OutputFiles(tag) and so relies on the
 		// output paths being set which must be done before or during
 		// GenerateAndroidBuildActions.
-		m.distFiles = m.GenerateTaggedDistFiles(ctx)
+		installFiles.DistFiles = m.GenerateTaggedDistFiles(ctx)
 		if ctx.Failed() {
 			return
 		}
 
-		SetProvider(ctx, InstallFilesProvider, InstallFilesInfo{
-			InstallFiles:    ctx.installFiles,
-			CheckbuildFiles: ctx.checkbuildFiles,
-			PackagingSpecs:  ctx.packagingSpecs,
-			KatiInstalls:    ctx.katiInstalls,
-			KatiSymlinks:    ctx.katiSymlinks,
-			TestData:        ctx.testData,
-		})
+		installFiles.LicenseMetadataFile = ctx.licenseMetadataFile
+		installFiles.InstallFiles = ctx.installFiles
+		installFiles.CheckbuildFiles = ctx.checkbuildFiles
+		installFiles.PackagingSpecs = ctx.packagingSpecs
+		installFiles.KatiInstalls = ctx.katiInstalls
+		installFiles.KatiSymlinks = ctx.katiSymlinks
+		installFiles.TestData = ctx.testData
 	} else if ctx.Config().AllowMissingDependencies() {
 		// If the module is not enabled it will not create any build rules, nothing will call
 		// ctx.GetMissingDependencies(), and blueprint will consider the missing dependencies to be unhandled
@@ -2000,10 +1993,13 @@
 		}
 	}
 
-	m.installFilesDepSet = NewDepSet[InstallPath](TOPOLOGICAL, ctx.installFiles, dependencyInstallFiles)
+	ctx.TransitiveInstallFiles = NewDepSet[InstallPath](TOPOLOGICAL, ctx.installFiles, dependencyInstallFiles)
+	installFiles.TransitiveInstallFiles = ctx.TransitiveInstallFiles
 	m.packagingSpecsDepSet = NewDepSet[PackagingSpec](TOPOLOGICAL, ctx.packagingSpecs, dependencyPackagingSpecs)
+	installFiles.TransitivePackagingSpecs = m.packagingSpecsDepSet
 
-	buildLicenseMetadata(ctx, m.licenseMetadataFile)
+	SetProvider(ctx, InstallFilesProvider, installFiles)
+	buildLicenseMetadata(ctx, ctx.licenseMetadataFile)
 
 	if m.moduleInfoJSON != nil {
 		var installed InstallPaths
diff --git a/android/module_context.go b/android/module_context.go
index e9fbb8c..f5104b8 100644
--- a/android/module_context.go
+++ b/android/module_context.go
@@ -107,65 +107,65 @@
 	// InstallExecutable creates a rule to copy srcPath to name in the installPath directory,
 	// with the given additional dependencies.  The file is marked executable after copying.
 	//
-	// The installed file will be returned by FilesToInstall(), and the PackagingSpec for the
-	// installed file will be returned by PackagingSpecs() on this module or by
-	// TransitivePackagingSpecs() on modules that depend on this module through dependency tags
-	// for which IsInstallDepNeeded returns true.
+	// The installed file can be accessed by InstallFilesInfo.InstallFiles, and the PackagingSpec
+	// for the installed file can be accessed by InstallFilesInfo.PackagingSpecs on this module
+	// or by InstallFilesInfo.TransitivePackagingSpecs on modules that depend on this module through
+	// dependency tags for which IsInstallDepNeeded returns true.
 	InstallExecutable(installPath InstallPath, name string, srcPath Path, deps ...InstallPath) InstallPath
 
 	// InstallFile creates a rule to copy srcPath to name in the installPath directory,
 	// with the given additional dependencies.
 	//
-	// The installed file will be returned by FilesToInstall(), and the PackagingSpec for the
-	// installed file will be returned by PackagingSpecs() on this module or by
-	// TransitivePackagingSpecs() on modules that depend on this module through dependency tags
-	// for which IsInstallDepNeeded returns true.
+	// The installed file can be accessed by InstallFilesInfo.InstallFiles, and the PackagingSpec
+	// for the installed file can be accessed by InstallFilesInfo.PackagingSpecs on this module
+	// or by InstallFilesInfo.TransitivePackagingSpecs on modules that depend on this module through
+	// dependency tags for which IsInstallDepNeeded returns true.
 	InstallFile(installPath InstallPath, name string, srcPath Path, deps ...InstallPath) InstallPath
 
 	// InstallFileWithExtraFilesZip creates a rule to copy srcPath to name in the installPath
 	// directory, and also unzip a zip file containing extra files to install into the same
 	// directory.
 	//
-	// The installed file will be returned by FilesToInstall(), and the PackagingSpec for the
-	// installed file will be returned by PackagingSpecs() on this module or by
-	// TransitivePackagingSpecs() on modules that depend on this module through dependency tags
-	// for which IsInstallDepNeeded returns true.
+	// The installed file can be accessed by InstallFilesInfo.InstallFiles, and the PackagingSpec
+	// for the installed file can be accessed by InstallFilesInfo.PackagingSpecs on this module
+	// or by InstallFilesInfo.TransitivePackagingSpecs on modules that depend on this module through
+	// dependency tags for which IsInstallDepNeeded returns true.
 	InstallFileWithExtraFilesZip(installPath InstallPath, name string, srcPath Path, extraZip Path, deps ...InstallPath) InstallPath
 
 	// InstallSymlink creates a rule to create a symlink from src srcPath to name in the installPath
 	// directory.
 	//
-	// The installed symlink will be returned by FilesToInstall(), and the PackagingSpec for the
-	// installed file will be returned by PackagingSpecs() on this module or by
-	// TransitivePackagingSpecs() on modules that depend on this module through dependency tags
-	// for which IsInstallDepNeeded returns true.
+	// The installed symlink can be accessed by InstallFilesInfo.InstallFiles, and the PackagingSpec
+	// for the installed file can be accessed by InstallFilesInfo.PackagingSpecs on this module
+	// or by InstallFilesInfo.TransitivePackagingSpecs on modules that depend on this module through
+	// dependency tags for which IsInstallDepNeeded returns true.
 	InstallSymlink(installPath InstallPath, name string, srcPath InstallPath) InstallPath
 
 	// InstallAbsoluteSymlink creates a rule to create an absolute symlink from src srcPath to name
 	// in the installPath directory.
 	//
-	// The installed symlink will be returned by FilesToInstall(), and the PackagingSpec for the
-	// installed file will be returned by PackagingSpecs() on this module or by
-	// TransitivePackagingSpecs() on modules that depend on this module through dependency tags
-	// for which IsInstallDepNeeded returns true.
+	// The installed symlink can be accessed by InstallFilesInfo.InstallFiles, and the PackagingSpec
+	// for the installed file can be accessed by InstallFilesInfo.PackagingSpecs on this module
+	// or by InstallFilesInfo.TransitivePackagingSpecs on modules that depend on this module through
+	// dependency tags for which IsInstallDepNeeded returns true.
 	InstallAbsoluteSymlink(installPath InstallPath, name string, absPath string) InstallPath
 
 	// InstallTestData creates rules to install test data (e.g. data files used during a test) into
 	// the installPath directory.
 	//
-	// The installed files will be returned by FilesToInstall(), and the PackagingSpec for the
-	// installed files will be returned by PackagingSpecs() on this module or by
-	// TransitivePackagingSpecs() on modules that depend on this module through dependency tags
-	// for which IsInstallDepNeeded returns true.
+	// The installed files can be accessed by InstallFilesInfo.InstallFiles, and the PackagingSpec
+	// for the installed files can be accessed by InstallFilesInfo.PackagingSpecs on this module
+	// or by InstallFilesInfo.TransitivePackagingSpecs on modules that depend on this module through
+	// dependency tags for which IsInstallDepNeeded returns true.
 	InstallTestData(installPath InstallPath, data []DataPath) InstallPaths
 
 	// PackageFile creates a PackagingSpec as if InstallFile was called, but without creating
 	// the rule to copy the file.  This is useful to define how a module would be packaged
 	// without installing it into the global installation directories.
 	//
-	// The created PackagingSpec for the will be returned by PackagingSpecs() on this module or by
-	// TransitivePackagingSpecs() on modules that depend on this module through dependency tags
-	// for which IsInstallDepNeeded returns true.
+	// The created PackagingSpec can be accessed by InstallFilesInfo.PackagingSpecs on this module
+	// or by InstallFilesInfo.TransitivePackagingSpecs on modules that depend on this module through
+	// dependency tags for which IsInstallDepNeeded returns true.
 	PackageFile(installPath InstallPath, name string, srcPath Path) PackagingSpec
 
 	CheckbuildFile(srcPath Path)
@@ -218,6 +218,10 @@
 
 	GetOutputFiles() OutputFilesInfo
 
+	// SetLicenseInstallMap stores the set of dependency module:location mappings for files in an
+	// apex container for use when generation the license metadata file.
+	SetLicenseInstallMap(installMap []string)
+
 	// ComplianceMetadataInfo returns a ComplianceMetadataInfo instance for different module types to dump metadata,
 	// which usually happens in GenerateAndroidBuildActions() of a module type.
 	// See android.ModuleBase.complianceMetadataInfo
@@ -236,6 +240,15 @@
 	// the OutputFilesProvider in GenerateBuildActions
 	outputFiles OutputFilesInfo
 
+	TransitiveInstallFiles *DepSet[InstallPath]
+
+	// set of dependency module:location mappings used to populate the license metadata for
+	// apex containers.
+	licenseInstallMap []string
+
+	// The path to the generated license metadata file for the module.
+	licenseMetadataFile WritablePath
+
 	katiInstalls katiInstalls
 	katiSymlinks katiInstalls
 
@@ -521,7 +534,7 @@
 	}
 
 	if m.requiresFullInstall() {
-		deps = append(deps, InstallPaths(m.module.base().installFilesDepSet.ToList())...)
+		deps = append(deps, InstallPaths(m.TransitiveInstallFiles.ToList())...)
 		deps = append(deps, m.module.base().installedInitRcPaths...)
 		deps = append(deps, m.module.base().installedVintfFragmentsPaths...)
 
@@ -704,7 +717,7 @@
 }
 
 func (m *moduleContext) LicenseMetadataFile() Path {
-	return m.module.base().licenseMetadataFile
+	return m.licenseMetadataFile
 }
 
 func (m *moduleContext) ModuleInfoJSON() *ModuleInfoJSON {
@@ -738,6 +751,10 @@
 	return m.outputFiles
 }
 
+func (m *moduleContext) SetLicenseInstallMap(installMap []string) {
+	m.licenseInstallMap = append(m.licenseInstallMap, installMap...)
+}
+
 func (m *moduleContext) ComplianceMetadataInfo() *ComplianceMetadataInfo {
 	if complianceMetadataInfo := m.module.base().complianceMetadataInfo; complianceMetadataInfo != nil {
 		return complianceMetadataInfo
diff --git a/android/module_test.go b/android/module_test.go
index 92041ec..d64e3a5 100644
--- a/android/module_test.go
+++ b/android/module_test.go
@@ -722,6 +722,7 @@
 				propInfo{Name: "Arch.X86_64.A", Type: "string", Value: "x86_64 a"},
 				propInfo{Name: "B", Type: "bool", Value: "true"},
 				propInfo{Name: "C", Type: "string slice", Values: []string{"default_c", "c"}},
+				propInfo{Name: "Defaults", Type: "string slice", Values: []string{"foo_defaults"}},
 				propInfo{Name: "Embedded_prop", Type: "string", Value: "a"},
 				propInfo{Name: "Name", Type: "string", Value: "foo"},
 				propInfo{Name: "Nested.E", Type: "string", Value: "nested e"},
diff --git a/android/notices.go b/android/notices.go
index b9c1682..3c41d92 100644
--- a/android/notices.go
+++ b/android/notices.go
@@ -36,10 +36,22 @@
 	return SortedUniqueStrings(dirs)
 }
 
-func modulesLicenseMetadata(ctx BuilderContext, modules ...Module) Paths {
+type BuilderAndOtherModuleProviderContext interface {
+	BuilderContext
+	OtherModuleProviderContext
+}
+
+func modulesLicenseMetadata(ctx OtherModuleProviderContext, modules ...Module) Paths {
 	result := make(Paths, 0, len(modules))
+	mctx, isMctx := ctx.(ModuleContext)
 	for _, module := range modules {
-		if mf := module.base().licenseMetadataFile; mf != nil {
+		var mf Path
+		if isMctx && mctx.Module() == module {
+			mf = mctx.LicenseMetadataFile()
+		} else {
+			mf = OtherModuleProviderOrDefault(ctx, module, InstallFilesProvider).LicenseMetadataFile
+		}
+		if mf != nil {
 			result = append(result, mf)
 		}
 	}
@@ -48,7 +60,7 @@
 
 // buildNoticeOutputFromLicenseMetadata writes out a notice file.
 func buildNoticeOutputFromLicenseMetadata(
-	ctx BuilderContext, tool, ruleName string, outputFile WritablePath,
+	ctx BuilderAndOtherModuleProviderContext, tool, ruleName string, outputFile WritablePath,
 	libraryName string, stripPrefix []string, modules ...Module) {
 	depsFile := outputFile.ReplaceExtension(ctx, strings.TrimPrefix(outputFile.Ext()+".d", "."))
 	rule := NewRuleBuilder(pctx, ctx)
@@ -84,7 +96,7 @@
 // on the license metadata files for the input `modules` defaulting to the
 // current context module if none given.
 func BuildNoticeTextOutputFromLicenseMetadata(
-	ctx BuilderContext, outputFile WritablePath, ruleName, libraryName string,
+	ctx BuilderAndOtherModuleProviderContext, outputFile WritablePath, ruleName, libraryName string,
 	stripPrefix []string, modules ...Module) {
 	buildNoticeOutputFromLicenseMetadata(ctx, "textnotice", "text_notice_"+ruleName,
 		outputFile, libraryName, stripPrefix, modules...)
@@ -94,7 +106,7 @@
 // on the license metadata files for the input `modules` defaulting to the
 // current context module if none given.
 func BuildNoticeHtmlOutputFromLicenseMetadata(
-	ctx BuilderContext, outputFile WritablePath, ruleName, libraryName string,
+	ctx BuilderAndOtherModuleProviderContext, outputFile WritablePath, ruleName, libraryName string,
 	stripPrefix []string, modules ...Module) {
 	buildNoticeOutputFromLicenseMetadata(ctx, "htmlnotice", "html_notice_"+ruleName,
 		outputFile, libraryName, stripPrefix, modules...)
@@ -104,7 +116,7 @@
 // on the license metadata files for the input `modules` defaulting to the
 // current context module if none given.
 func BuildNoticeXmlOutputFromLicenseMetadata(
-	ctx BuilderContext, outputFile WritablePath, ruleName, libraryName string,
+	ctx BuilderAndOtherModuleProviderContext, outputFile WritablePath, ruleName, libraryName string,
 	stripPrefix []string, modules ...Module) {
 	buildNoticeOutputFromLicenseMetadata(ctx, "xmlnotice", "xml_notice_"+ruleName,
 		outputFile, libraryName, stripPrefix, modules...)
diff --git a/android/packaging.go b/android/packaging.go
index c247ed2..42009d5 100644
--- a/android/packaging.go
+++ b/android/packaging.go
@@ -346,7 +346,8 @@
 		if pi, ok := ctx.OtherModuleDependencyTag(child).(PackagingItem); !ok || !pi.IsPackagingItem() {
 			return
 		}
-		for _, ps := range child.TransitivePackagingSpecs() {
+		for _, ps := range OtherModuleProviderOrDefault(
+			ctx, child, InstallFilesProvider).TransitivePackagingSpecs.ToList() {
 			if !filterArch(ps) {
 				continue
 			}
diff --git a/android/rule_builder.go b/android/rule_builder.go
index 464aca4..95e2b92 100644
--- a/android/rule_builder.go
+++ b/android/rule_builder.go
@@ -580,6 +580,16 @@
 				})
 			}
 
+			// Set OUT_DIR to the relative path of the sandboxed out directory.
+			// Otherwise, OUT_DIR will be inherited from the rest of the build,
+			// which will allow scripts to escape the sandbox if OUT_DIR is an
+			// absolute path.
+			command.Env = append(command.Env, &sbox_proto.EnvironmentVariable{
+				Name: proto.String("OUT_DIR"),
+				State: &sbox_proto.EnvironmentVariable_Value{
+					Value: sboxOutSubDir,
+				},
+			})
 			command.Chdir = proto.Bool(true)
 		}
 
diff --git a/android/variable.go b/android/variable.go
index c8744ed..10205e3 100644
--- a/android/variable.go
+++ b/android/variable.go
@@ -514,11 +514,6 @@
 	ProductPropFiles   []string `json:",omitempty"`
 
 	EnableUffdGc *string `json:",omitempty"`
-
-	BoardAvbEnable                         *bool    `json:",omitempty"`
-	BoardAvbSystemAddHashtreeFooterArgs    []string `json:",omitempty"`
-	DeviceFrameworkCompatibilityMatrixFile []string `json:",omitempty"`
-	DeviceProductCompatibilityMatrixFile   []string `json:",omitempty"`
 }
 
 type PartitionQualifiedVariablesType struct {
diff --git a/apex/apex.go b/apex/apex.go
index ec71c18..6286be3 100644
--- a/apex/apex.go
+++ b/apex/apex.go
@@ -699,6 +699,8 @@
 	// If not-nil and an APEX is a member of an SDK then dependencies of that APEX with this tag will
 	// also be added as exported members of that SDK.
 	memberType android.SdkMemberType
+
+	installable bool
 }
 
 func (d *dependencyTag) SdkMemberType(_ android.Module) android.SdkMemberType {
@@ -717,18 +719,23 @@
 	return !d.sourceOnly
 }
 
+func (d *dependencyTag) InstallDepNeeded() bool {
+	return d.installable
+}
+
 var _ android.ReplaceSourceWithPrebuilt = &dependencyTag{}
 var _ android.SdkMemberDependencyTag = &dependencyTag{}
 
 var (
-	androidAppTag   = &dependencyTag{name: "androidApp", payload: true}
-	bpfTag          = &dependencyTag{name: "bpf", payload: true}
-	certificateTag  = &dependencyTag{name: "certificate"}
-	dclaTag         = &dependencyTag{name: "dcla"}
-	executableTag   = &dependencyTag{name: "executable", payload: true}
-	fsTag           = &dependencyTag{name: "filesystem", payload: true}
-	bcpfTag         = &dependencyTag{name: "bootclasspathFragment", payload: true, sourceOnly: true, memberType: java.BootclasspathFragmentSdkMemberType}
-	sscpfTag        = &dependencyTag{name: "systemserverclasspathFragment", payload: true, sourceOnly: true, memberType: java.SystemServerClasspathFragmentSdkMemberType}
+	androidAppTag  = &dependencyTag{name: "androidApp", payload: true}
+	bpfTag         = &dependencyTag{name: "bpf", payload: true}
+	certificateTag = &dependencyTag{name: "certificate"}
+	dclaTag        = &dependencyTag{name: "dcla"}
+	executableTag  = &dependencyTag{name: "executable", payload: true}
+	fsTag          = &dependencyTag{name: "filesystem", payload: true}
+	bcpfTag        = &dependencyTag{name: "bootclasspathFragment", payload: true, sourceOnly: true, memberType: java.BootclasspathFragmentSdkMemberType}
+	// The dexpreopt artifacts of apex system server jars are installed onto system image.
+	sscpfTag        = &dependencyTag{name: "systemserverclasspathFragment", payload: true, sourceOnly: true, memberType: java.SystemServerClasspathFragmentSdkMemberType, installable: true}
 	compatConfigTag = &dependencyTag{name: "compatConfig", payload: true, sourceOnly: true, memberType: java.CompatConfigSdkMemberType}
 	javaLibTag      = &dependencyTag{name: "javaLib", payload: true}
 	jniLibTag       = &dependencyTag{name: "jniLib", payload: true}
@@ -1686,12 +1693,10 @@
 	if sdkLib, ok := module.(*java.SdkLibrary); ok {
 		for _, install := range sdkLib.BuiltInstalledForApex() {
 			af.requiredModuleNames = append(af.requiredModuleNames, install.FullModuleName())
-			install.PackageFile(ctx)
 		}
 	} else if dexpreopter, ok := module.(java.DexpreopterInterface); ok {
 		for _, install := range dexpreopter.DexpreoptBuiltInstalledForApex() {
 			af.requiredModuleNames = append(af.requiredModuleNames, install.FullModuleName())
-			install.PackageFile(ctx)
 		}
 	}
 	return af
diff --git a/apex/builder.go b/apex/builder.go
index bfe1692..0d08483 100644
--- a/apex/builder.go
+++ b/apex/builder.go
@@ -595,7 +595,7 @@
 	if len(installMapSet) > 0 {
 		var installs []string
 		installs = append(installs, android.SortedKeys(installMapSet)...)
-		a.SetLicenseInstallMap(installs)
+		ctx.SetLicenseInstallMap(installs)
 	}
 
 	////////////////////////////////////////////////////////////////////////////////////////////
diff --git a/apex/prebuilt.go b/apex/prebuilt.go
index 9dc8a63..f1a134e 100644
--- a/apex/prebuilt.go
+++ b/apex/prebuilt.go
@@ -195,7 +195,6 @@
 	// If this apex contains a system server jar, then the dexpreopt artifacts should be added as required
 	for _, install := range p.Dexpreopter.DexpreoptBuiltInstalledForApex() {
 		p.requiredModuleNames = append(p.requiredModuleNames, install.FullModuleName())
-		install.PackageFile(ctx)
 	}
 }
 
diff --git a/cmd/sbox/sbox.go b/cmd/sbox/sbox.go
index e69a930..6459ea1 100644
--- a/cmd/sbox/sbox.go
+++ b/cmd/sbox/sbox.go
@@ -27,6 +27,7 @@
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -51,6 +52,8 @@
 	sandboxDirPlaceholder = "__SBOX_SANDBOX_DIR__"
 )
 
+var envVarNameRegex = regexp.MustCompile("^[a-zA-Z0-9_-]+$")
+
 func init() {
 	flag.StringVar(&sandboxesRoot, "sandbox-path", "",
 		"root of temp directory to put the sandbox into")
@@ -238,6 +241,48 @@
 	return &manifest, nil
 }
 
+func createEnv(command *sbox_proto.Command) ([]string, error) {
+	env := []string{}
+	if command.DontInheritEnv == nil || !*command.DontInheritEnv {
+		env = os.Environ()
+	}
+	for _, envVar := range command.Env {
+		if envVar.Name == nil || !envVarNameRegex.MatchString(*envVar.Name) {
+			name := "nil"
+			if envVar.Name != nil {
+				name = *envVar.Name
+			}
+			return nil, fmt.Errorf("Invalid environment variable name: %q", name)
+		}
+		if envVar.State == nil {
+			return nil, fmt.Errorf("Must set state")
+		}
+		switch state := envVar.State.(type) {
+		case *sbox_proto.EnvironmentVariable_Value:
+			env = append(env, *envVar.Name+"="+state.Value)
+		case *sbox_proto.EnvironmentVariable_Unset:
+			if !state.Unset {
+				return nil, fmt.Errorf("Can't have unset set to false")
+			}
+			prefix := *envVar.Name + "="
+			for i := 0; i < len(env); i++ {
+				if strings.HasPrefix(env[i], prefix) {
+					env = append(env[:i], env[i+1:]...)
+					i--
+				}
+			}
+		case *sbox_proto.EnvironmentVariable_Inherit:
+			if !state.Inherit {
+				return nil, fmt.Errorf("Can't have inherit set to false")
+			}
+			env = append(env, *envVar.Name+"="+os.Getenv(*envVar.Name))
+		default:
+			return nil, fmt.Errorf("Unhandled state type")
+		}
+	}
+	return env, nil
+}
+
 // runCommand runs a single command from a manifest.  If the command references the
 // __SBOX_DEPFILE__ placeholder it returns the name of the depfile that was used.
 func runCommand(command *sbox_proto.Command, tempDir string, commandIndex int) (depFile string, err error) {
@@ -313,6 +358,12 @@
 			return "", fmt.Errorf("Failed to update PATH: %w", err)
 		}
 	}
+
+	cmd.Env, err = createEnv(command)
+	if err != nil {
+		return "", err
+	}
+
 	err = cmd.Run()
 
 	if err != nil {
diff --git a/cmd/sbox/sbox_proto/sbox.pb.go b/cmd/sbox/sbox_proto/sbox.pb.go
index 7c84f2c..271039c 100644
--- a/cmd/sbox/sbox_proto/sbox.pb.go
+++ b/cmd/sbox/sbox_proto/sbox.pb.go
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.9.1
+// 	protoc-gen-go v1.33.0
+// 	protoc        v3.21.12
 // source: sbox.proto
 
 package sbox_proto
@@ -116,6 +116,13 @@
 	// A list of files that will be copied before the sandboxed command, and whose contents should be
 	// copied as if they were listed in copy_before.
 	RspFiles []*RspFile `protobuf:"bytes,6,rep,name=rsp_files,json=rspFiles" json:"rsp_files,omitempty"`
+	// The environment variables that will be set or unset while running the command.
+	// Also see dont_inherit_env.
+	Env []*EnvironmentVariable `protobuf:"bytes,7,rep,name=env" json:"env,omitempty"`
+	// By default, all environment variables are inherited from the calling process, but may be
+	// replaced or unset by env. If dont_inherit_env is set, no environment variables will be
+	// inherited, and instead only the variables in env will be defined.
+	DontInheritEnv *bool `protobuf:"varint,8,opt,name=dont_inherit_env,json=dontInheritEnv" json:"dont_inherit_env,omitempty"`
 }
 
 func (x *Command) Reset() {
@@ -192,6 +199,129 @@
 	return nil
 }
 
+func (x *Command) GetEnv() []*EnvironmentVariable {
+	if x != nil {
+		return x.Env
+	}
+	return nil
+}
+
+func (x *Command) GetDontInheritEnv() bool {
+	if x != nil && x.DontInheritEnv != nil {
+		return *x.DontInheritEnv
+	}
+	return false
+}
+
+type EnvironmentVariable struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The name of the environment variable
+	Name *string `protobuf:"bytes,1,req,name=name" json:"name,omitempty"`
+	// Types that are assignable to State:
+	//
+	//	*EnvironmentVariable_Value
+	//	*EnvironmentVariable_Unset
+	//	*EnvironmentVariable_Inherit
+	State isEnvironmentVariable_State `protobuf_oneof:"state"`
+}
+
+func (x *EnvironmentVariable) Reset() {
+	*x = EnvironmentVariable{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_sbox_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EnvironmentVariable) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnvironmentVariable) ProtoMessage() {}
+
+func (x *EnvironmentVariable) ProtoReflect() protoreflect.Message {
+	mi := &file_sbox_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnvironmentVariable.ProtoReflect.Descriptor instead.
+func (*EnvironmentVariable) Descriptor() ([]byte, []int) {
+	return file_sbox_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *EnvironmentVariable) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
+	}
+	return ""
+}
+
+func (m *EnvironmentVariable) GetState() isEnvironmentVariable_State {
+	if m != nil {
+		return m.State
+	}
+	return nil
+}
+
+func (x *EnvironmentVariable) GetValue() string {
+	if x, ok := x.GetState().(*EnvironmentVariable_Value); ok {
+		return x.Value
+	}
+	return ""
+}
+
+func (x *EnvironmentVariable) GetUnset() bool {
+	if x, ok := x.GetState().(*EnvironmentVariable_Unset); ok {
+		return x.Unset
+	}
+	return false
+}
+
+func (x *EnvironmentVariable) GetInherit() bool {
+	if x, ok := x.GetState().(*EnvironmentVariable_Inherit); ok {
+		return x.Inherit
+	}
+	return false
+}
+
+type isEnvironmentVariable_State interface {
+	isEnvironmentVariable_State()
+}
+
+type EnvironmentVariable_Value struct {
+	// The value to set the environment variable to.
+	Value string `protobuf:"bytes,2,opt,name=value,oneof"`
+}
+
+type EnvironmentVariable_Unset struct {
+	// This environment variable should be unset in the command.
+	Unset bool `protobuf:"varint,3,opt,name=unset,oneof"`
+}
+
+type EnvironmentVariable_Inherit struct {
+	// This environment variable should be inherited from the parent process.
+	// Can be combined with dont_inherit_env to only inherit certain environment
+	// variables.
+	Inherit bool `protobuf:"varint,4,opt,name=inherit,oneof"`
+}
+
+func (*EnvironmentVariable_Value) isEnvironmentVariable_State() {}
+
+func (*EnvironmentVariable_Unset) isEnvironmentVariable_State() {}
+
+func (*EnvironmentVariable_Inherit) isEnvironmentVariable_State() {}
+
 // Copy describes a from-to pair of files to copy.  The paths may be relative, the root that they
 // are relative to is specific to the context the Copy is used in and will be different for
 // from and to.
@@ -209,7 +339,7 @@
 func (x *Copy) Reset() {
 	*x = Copy{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_sbox_proto_msgTypes[2]
+		mi := &file_sbox_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -222,7 +352,7 @@
 func (*Copy) ProtoMessage() {}
 
 func (x *Copy) ProtoReflect() protoreflect.Message {
-	mi := &file_sbox_proto_msgTypes[2]
+	mi := &file_sbox_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -235,7 +365,7 @@
 
 // Deprecated: Use Copy.ProtoReflect.Descriptor instead.
 func (*Copy) Descriptor() ([]byte, []int) {
-	return file_sbox_proto_rawDescGZIP(), []int{2}
+	return file_sbox_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *Copy) GetFrom() string {
@@ -274,7 +404,7 @@
 func (x *RspFile) Reset() {
 	*x = RspFile{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_sbox_proto_msgTypes[3]
+		mi := &file_sbox_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -287,7 +417,7 @@
 func (*RspFile) ProtoMessage() {}
 
 func (x *RspFile) ProtoReflect() protoreflect.Message {
-	mi := &file_sbox_proto_msgTypes[3]
+	mi := &file_sbox_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -300,7 +430,7 @@
 
 // Deprecated: Use RspFile.ProtoReflect.Descriptor instead.
 func (*RspFile) Descriptor() ([]byte, []int) {
-	return file_sbox_proto_rawDescGZIP(), []int{3}
+	return file_sbox_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *RspFile) GetFile() string {
@@ -330,7 +460,7 @@
 func (x *PathMapping) Reset() {
 	*x = PathMapping{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_sbox_proto_msgTypes[4]
+		mi := &file_sbox_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -343,7 +473,7 @@
 func (*PathMapping) ProtoMessage() {}
 
 func (x *PathMapping) ProtoReflect() protoreflect.Message {
-	mi := &file_sbox_proto_msgTypes[4]
+	mi := &file_sbox_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -356,7 +486,7 @@
 
 // Deprecated: Use PathMapping.ProtoReflect.Descriptor instead.
 func (*PathMapping) Descriptor() ([]byte, []int) {
-	return file_sbox_proto_rawDescGZIP(), []int{4}
+	return file_sbox_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *PathMapping) GetFrom() string {
@@ -383,7 +513,7 @@
 	0x08, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x6f, 0x75, 0x74,
 	0x70, 0x75, 0x74, 0x5f, 0x64, 0x65, 0x70, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
 	0x09, 0x52, 0x0d, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x44, 0x65, 0x70, 0x66, 0x69, 0x6c, 0x65,
-	0x22, 0xdc, 0x01, 0x0a, 0x07, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x2b, 0x0a, 0x0b,
+	0x22, 0xb3, 0x02, 0x0a, 0x07, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x2b, 0x0a, 0x0b,
 	0x63, 0x6f, 0x70, 0x79, 0x5f, 0x62, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28,
 	0x0b, 0x32, 0x0a, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x43, 0x6f, 0x70, 0x79, 0x52, 0x0a, 0x63,
 	0x6f, 0x70, 0x79, 0x42, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x64,
@@ -396,23 +526,37 @@
 	0x73, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x48,
 	0x61, 0x73, 0x68, 0x12, 0x2a, 0x0a, 0x09, 0x72, 0x73, 0x70, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73,
 	0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x52, 0x73,
-	0x70, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x08, 0x72, 0x73, 0x70, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22,
-	0x4a, 0x0a, 0x04, 0x43, 0x6f, 0x70, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x18,
-	0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x74,
-	0x6f, 0x18, 0x02, 0x20, 0x02, 0x28, 0x09, 0x52, 0x02, 0x74, 0x6f, 0x12, 0x1e, 0x0a, 0x0a, 0x65,
-	0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0a, 0x65, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x22, 0x55, 0x0a, 0x07, 0x52,
-	0x73, 0x70, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x01,
-	0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x36, 0x0a, 0x0d, 0x70, 0x61,
-	0x74, 0x68, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x11, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70,
-	0x70, 0x69, 0x6e, 0x67, 0x52, 0x0c, 0x70, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
-	0x67, 0x73, 0x22, 0x31, 0x0a, 0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
-	0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52,
-	0x04, 0x66, 0x72, 0x6f, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x74, 0x6f, 0x18, 0x02, 0x20, 0x02, 0x28,
-	0x09, 0x52, 0x02, 0x74, 0x6f, 0x42, 0x23, 0x5a, 0x21, 0x61, 0x6e, 0x64, 0x72, 0x6f, 0x69, 0x64,
-	0x2f, 0x73, 0x6f, 0x6f, 0x6e, 0x67, 0x2f, 0x63, 0x6d, 0x64, 0x2f, 0x73, 0x62, 0x6f, 0x78, 0x2f,
-	0x73, 0x62, 0x6f, 0x78, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x70, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x08, 0x72, 0x73, 0x70, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12,
+	0x2b, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x73,
+	0x62, 0x6f, 0x78, 0x2e, 0x45, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x56,
+	0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x28, 0x0a, 0x10,
+	0x64, 0x6f, 0x6e, 0x74, 0x5f, 0x69, 0x6e, 0x68, 0x65, 0x72, 0x69, 0x74, 0x5f, 0x65, 0x6e, 0x76,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x64, 0x6f, 0x6e, 0x74, 0x49, 0x6e, 0x68, 0x65,
+	0x72, 0x69, 0x74, 0x45, 0x6e, 0x76, 0x22, 0x7e, 0x0a, 0x13, 0x45, 0x6e, 0x76, 0x69, 0x72, 0x6f,
+	0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x16, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x48, 0x00, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x16, 0x0a, 0x05, 0x75, 0x6e, 0x73,
+	0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x05, 0x75, 0x6e, 0x73, 0x65,
+	0x74, 0x12, 0x1a, 0x0a, 0x07, 0x69, 0x6e, 0x68, 0x65, 0x72, 0x69, 0x74, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x08, 0x48, 0x00, 0x52, 0x07, 0x69, 0x6e, 0x68, 0x65, 0x72, 0x69, 0x74, 0x42, 0x07, 0x0a,
+	0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x22, 0x4a, 0x0a, 0x04, 0x43, 0x6f, 0x70, 0x79, 0x12, 0x12,
+	0x0a, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x66, 0x72,
+	0x6f, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x74, 0x6f, 0x18, 0x02, 0x20, 0x02, 0x28, 0x09, 0x52, 0x02,
+	0x74, 0x6f, 0x12, 0x1e, 0x0a, 0x0a, 0x65, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x65, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62,
+	0x6c, 0x65, 0x22, 0x55, 0x0a, 0x07, 0x52, 0x73, 0x70, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x66, 0x69, 0x6c,
+	0x65, 0x12, 0x36, 0x0a, 0x0d, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e,
+	0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x0c, 0x70, 0x61, 0x74,
+	0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x31, 0x0a, 0x0b, 0x50, 0x61, 0x74,
+	0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x72, 0x6f, 0x6d,
+	0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x12, 0x0e, 0x0a, 0x02,
+	0x74, 0x6f, 0x18, 0x02, 0x20, 0x02, 0x28, 0x09, 0x52, 0x02, 0x74, 0x6f, 0x42, 0x23, 0x5a, 0x21,
+	0x61, 0x6e, 0x64, 0x72, 0x6f, 0x69, 0x64, 0x2f, 0x73, 0x6f, 0x6f, 0x6e, 0x67, 0x2f, 0x63, 0x6d,
+	0x64, 0x2f, 0x73, 0x62, 0x6f, 0x78, 0x2f, 0x73, 0x62, 0x6f, 0x78, 0x5f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f,
 }
 
 var (
@@ -427,25 +571,27 @@
 	return file_sbox_proto_rawDescData
 }
 
-var file_sbox_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_sbox_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_sbox_proto_goTypes = []interface{}{
-	(*Manifest)(nil),    // 0: sbox.Manifest
-	(*Command)(nil),     // 1: sbox.Command
-	(*Copy)(nil),        // 2: sbox.Copy
-	(*RspFile)(nil),     // 3: sbox.RspFile
-	(*PathMapping)(nil), // 4: sbox.PathMapping
+	(*Manifest)(nil),            // 0: sbox.Manifest
+	(*Command)(nil),             // 1: sbox.Command
+	(*EnvironmentVariable)(nil), // 2: sbox.EnvironmentVariable
+	(*Copy)(nil),                // 3: sbox.Copy
+	(*RspFile)(nil),             // 4: sbox.RspFile
+	(*PathMapping)(nil),         // 5: sbox.PathMapping
 }
 var file_sbox_proto_depIdxs = []int32{
 	1, // 0: sbox.Manifest.commands:type_name -> sbox.Command
-	2, // 1: sbox.Command.copy_before:type_name -> sbox.Copy
-	2, // 2: sbox.Command.copy_after:type_name -> sbox.Copy
-	3, // 3: sbox.Command.rsp_files:type_name -> sbox.RspFile
-	4, // 4: sbox.RspFile.path_mappings:type_name -> sbox.PathMapping
-	5, // [5:5] is the sub-list for method output_type
-	5, // [5:5] is the sub-list for method input_type
-	5, // [5:5] is the sub-list for extension type_name
-	5, // [5:5] is the sub-list for extension extendee
-	0, // [0:5] is the sub-list for field type_name
+	3, // 1: sbox.Command.copy_before:type_name -> sbox.Copy
+	3, // 2: sbox.Command.copy_after:type_name -> sbox.Copy
+	4, // 3: sbox.Command.rsp_files:type_name -> sbox.RspFile
+	2, // 4: sbox.Command.env:type_name -> sbox.EnvironmentVariable
+	5, // 5: sbox.RspFile.path_mappings:type_name -> sbox.PathMapping
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
 }
 
 func init() { file_sbox_proto_init() }
@@ -479,7 +625,7 @@
 			}
 		}
 		file_sbox_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Copy); i {
+			switch v := v.(*EnvironmentVariable); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -491,7 +637,7 @@
 			}
 		}
 		file_sbox_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RspFile); i {
+			switch v := v.(*Copy); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -503,6 +649,18 @@
 			}
 		}
 		file_sbox_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RspFile); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_sbox_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PathMapping); i {
 			case 0:
 				return &v.state
@@ -515,13 +673,18 @@
 			}
 		}
 	}
+	file_sbox_proto_msgTypes[2].OneofWrappers = []interface{}{
+		(*EnvironmentVariable_Value)(nil),
+		(*EnvironmentVariable_Unset)(nil),
+		(*EnvironmentVariable_Inherit)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_sbox_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   5,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/cmd/sbox/sbox_proto/sbox.proto b/cmd/sbox/sbox_proto/sbox.proto
index 2f0dcf0..1158554 100644
--- a/cmd/sbox/sbox_proto/sbox.proto
+++ b/cmd/sbox/sbox_proto/sbox.proto
@@ -51,6 +51,30 @@
   // A list of files that will be copied before the sandboxed command, and whose contents should be
   // copied as if they were listed in copy_before.
   repeated RspFile rsp_files = 6;
+
+  // The environment variables that will be set or unset while running the command.
+  // Also see dont_inherit_env.
+  repeated EnvironmentVariable env = 7;
+
+  // By default, all environment variables are inherited from the calling process, but may be
+  // replaced or unset by env. If dont_inherit_env is set, no environment variables will be
+  // inherited, and instead only the variables in env will be defined.
+  optional bool dont_inherit_env = 8;
+}
+
+message EnvironmentVariable {
+  // The name of the environment variable
+  required string name = 1;
+  oneof state {
+    // The value to set the environment variable to.
+    string value = 2;
+    // This environment variable should be unset in the command.
+    bool unset = 3;
+    // This environment variable should be inherited from the parent process.
+    // Can be combined with dont_inherit_env to only inherit certain environment
+    // variables.
+    bool inherit = 4;
+  }
 }
 
 // Copy describes a from-to pair of files to copy.  The paths may be relative, the root that they
diff --git a/genrule/genrule.go b/genrule/genrule.go
index 9195643..b8b9968 100644
--- a/genrule/genrule.go
+++ b/genrule/genrule.go
@@ -320,7 +320,8 @@
 						ctx.ModuleErrorf("host tool %q missing output file", tool)
 						return
 					}
-					if specs := t.TransitivePackagingSpecs(); specs != nil {
+					if specs := android.OtherModuleProviderOrDefault(
+						ctx, t, android.InstallFilesProvider).TransitivePackagingSpecs.ToList(); specs != nil {
 						// If the HostToolProvider has PackgingSpecs, which are definitions of the
 						// required relative locations of the tool and its dependencies, use those
 						// instead.  They will be copied to those relative locations in the sbox
diff --git a/java/dexpreopt.go b/java/dexpreopt.go
index a38642a..e15ebb0 100644
--- a/java/dexpreopt.go
+++ b/java/dexpreopt.go
@@ -88,18 +88,11 @@
 				entries.SetString("LOCAL_MODULE_PATH", install.installDirOnDevice.String())
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", install.installFileOnDevice)
 				entries.SetString("LOCAL_NOT_AVAILABLE_FOR_PLATFORM", "false")
-				// Unset LOCAL_SOONG_INSTALLED_MODULE so that this does not default to the primary .apex file
-				// Without this, installation of the dexpreopt artifacts get skipped
-				entries.SetString("LOCAL_SOONG_INSTALLED_MODULE", "")
 			},
 		},
 	}
 }
 
-func (install dexpreopterInstall) PackageFile(ctx android.ModuleContext) android.PackagingSpec {
-	return ctx.PackageFile(install.installDirOnDevice, install.installFileOnDevice, install.outputPathOnHost)
-}
-
 type Dexpreopter struct {
 	dexpreopter
 }
@@ -583,13 +576,16 @@
 				// Preopting of boot classpath jars in the ART APEX are handled in
 				// java/dexpreopt_bootjars.go, and other APEX jars are not preopted.
 				// The installs will be handled by Make as sub-modules of the java library.
-				d.builtInstalledForApex = append(d.builtInstalledForApex, dexpreopterInstall{
+				di := dexpreopterInstall{
 					name:                arch + "-" + installBase,
 					moduleName:          libName,
 					outputPathOnHost:    install.From,
 					installDirOnDevice:  installPath,
 					installFileOnDevice: installBase,
-				})
+				}
+				ctx.InstallFile(di.installDirOnDevice, di.installFileOnDevice, di.outputPathOnHost)
+				d.builtInstalledForApex = append(d.builtInstalledForApex, di)
+
 			}
 		} else if !d.preventInstall {
 			ctx.InstallFile(installPath, installBase, install.From)
diff --git a/java/sdk.go b/java/sdk.go
index dd198ac..4537f19 100644
--- a/java/sdk.go
+++ b/java/sdk.go
@@ -308,10 +308,12 @@
 
 			rule.Command().
 				Text("rm -f").Output(aidl)
+
 			rule.Command().
 				BuiltTool("sdkparcelables").
 				Input(jar).
-				Output(aidl)
+				Output(aidl).
+				Flag("--guarantee_stable")
 
 			aidls = append(aidls, aidl)
 		}
diff --git a/java/systemserver_classpath_fragment.go b/java/systemserver_classpath_fragment.go
index bad2cf1..3225a3a 100644
--- a/java/systemserver_classpath_fragment.go
+++ b/java/systemserver_classpath_fragment.go
@@ -216,6 +216,11 @@
 	return tag == systemServerClasspathFragmentContentDepTag
 }
 
+// The dexpreopt artifacts of apex system server jars are installed onto system image.
+func (s systemServerClasspathFragmentContentDependencyTag) InstallDepNeeded() bool {
+	return true
+}
+
 func (s *SystemServerClasspathModule) ComponentDepsMutator(ctx android.BottomUpMutatorContext) {
 	module := ctx.Module()
 	_, isSourceModule := module.(*SystemServerClasspathModule)
diff --git a/ui/build/androidmk_denylist.go b/ui/build/androidmk_denylist.go
index bbac2db..2bad5a8 100644
--- a/ui/build/androidmk_denylist.go
+++ b/ui/build/androidmk_denylist.go
@@ -33,6 +33,7 @@
 	"kernel/tests/",
 	"libcore/",
 	"libnativehelper/",
+	"packages/",
 	"pdk/",
 	"prebuilts/",
 	"sdk/",