diff --git a/Android.bp b/Android.bp
index a70f73c..591e5c8 100644
--- a/Android.bp
+++ b/Android.bp
@@ -61,6 +61,7 @@
         "android/prebuilt_etc.go",
         "android/proto.go",
         "android/register.go",
+        "android/rule_builder.go",
         "android/sh_binary.go",
         "android/singleton.go",
         "android/testing.go",
@@ -77,9 +78,11 @@
         "android/expand_test.go",
         "android/namespace_test.go",
         "android/neverallow_test.go",
+        "android/onceper_test.go",
         "android/paths_test.go",
         "android/prebuilt_test.go",
         "android/prebuilt_etc_test.go",
+        "android/rule_builder_test.go",
         "android/util_test.go",
         "android/variable_test.go",
     ],
diff --git a/android/apex.go b/android/apex.go
index a93baf6..bf11ba2 100644
--- a/android/apex.go
+++ b/android/apex.go
@@ -139,6 +139,7 @@
 
 var apexData OncePer
 var apexNamesMapMutex sync.Mutex
+var apexNamesKey = NewOnceKey("apexNames")
 
 // This structure maintains the global mapping in between modules and APEXes.
 // Examples:
@@ -147,7 +148,7 @@
 // apexNamesMap()["foo"]["bar"] == false: module foo is indirectly depended on by APEX bar
 // apexNamesMap()["foo"]["bar"] doesn't exist: foo is not built for APEX bar
 func apexNamesMap() map[string]map[string]bool {
-	return apexData.Once("apexNames", func() interface{} {
+	return apexData.Once(apexNamesKey, func() interface{} {
 		return make(map[string]map[string]bool)
 	}).(map[string]map[string]bool)
 }
diff --git a/android/api_levels.go b/android/api_levels.go
index 1b56625..51d4703 100644
--- a/android/api_levels.go
+++ b/android/api_levels.go
@@ -51,8 +51,10 @@
 	return PathForOutput(ctx, "api_levels.json")
 }
 
+var apiLevelsMapKey = NewOnceKey("ApiLevelsMap")
+
 func getApiLevelsMap(config Config) map[string]int {
-	return config.Once("ApiLevelsMap", func() interface{} {
+	return config.Once(apiLevelsMapKey, func() interface{} {
 		baseApiLevel := 9000
 		apiLevelsMap := map[string]int{
 			"G":     9,
diff --git a/android/arch.go b/android/arch.go
index 953e6cf..ad812a4 100644
--- a/android/arch.go
+++ b/android/arch.go
@@ -879,7 +879,7 @@
 				propertiesValue.Interface()))
 		}
 
-		archPropTypes := archPropTypeMap.Once(t, func() interface{} {
+		archPropTypes := archPropTypeMap.Once(NewCustomOnceKey(t), func() interface{} {
 			return createArchType(t)
 		}).([]reflect.Type)
 
diff --git a/android/config.go b/android/config.go
index 7b22119..92010fc 100644
--- a/android/config.go
+++ b/android/config.go
@@ -665,6 +665,10 @@
 	}
 }
 
+func (c *config) DisableScudo() bool {
+	return Bool(c.productVariables.DisableScudo)
+}
+
 func (c *config) EnableXOM() bool {
 	if c.productVariables.EnableXOM == nil {
 		return true
diff --git a/android/onceper.go b/android/onceper.go
index f19f75c..6160506 100644
--- a/android/onceper.go
+++ b/android/onceper.go
@@ -24,8 +24,6 @@
 	valuesLock sync.Mutex
 }
 
-type valueMap map[interface{}]interface{}
-
 // Once computes a value the first time it is called with a given key per OncePer, and returns the
 // value without recomputing when called with the same key.  key must be hashable.
 func (once *OncePer) Once(key interface{}, value func() interface{}) interface{} {
@@ -50,6 +48,8 @@
 	return v
 }
 
+// Get returns the value previously computed with Once for a given key.  If Once has not been called for the given
+// key Get will panic.
 func (once *OncePer) Get(key interface{}) interface{} {
 	v, ok := once.values.Load(key)
 	if !ok {
@@ -59,10 +59,12 @@
 	return v
 }
 
+// OnceStringSlice is the same as Once, but returns the value cast to a []string
 func (once *OncePer) OnceStringSlice(key interface{}, value func() []string) []string {
 	return once.Once(key, func() interface{} { return value() }).([]string)
 }
 
+// OnceStringSlice is the same as Once, but returns two values cast to []string
 func (once *OncePer) Once2StringSlice(key interface{}, value func() ([]string, []string)) ([]string, []string) {
 	type twoStringSlice [2][]string
 	s := once.Once(key, func() interface{} {
@@ -72,3 +74,21 @@
 	}).(twoStringSlice)
 	return s[0], s[1]
 }
+
+// OnceKey is an opaque type to be used as the key in calls to Once.
+type OnceKey struct {
+	key interface{}
+}
+
+// NewOnceKey returns an opaque OnceKey object for the provided key.  Two calls to NewOnceKey with the same key string
+// DO NOT produce the same OnceKey object.
+func NewOnceKey(key string) OnceKey {
+	return OnceKey{&key}
+}
+
+// NewCustomOnceKey returns an opaque OnceKey object for the provided key.  The key can be any type that is valid as the
+// key in a map, i.e. comparable.  Two calls to NewCustomOnceKey with key values that compare equal will return OnceKey
+// objects that access the same value stored with Once.
+func NewCustomOnceKey(key interface{}) OnceKey {
+	return OnceKey{key}
+}
diff --git a/android/onceper_test.go b/android/onceper_test.go
new file mode 100644
index 0000000..d2ca9ad
--- /dev/null
+++ b/android/onceper_test.go
@@ -0,0 +1,135 @@
+// Copyright 2019 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package android
+
+import (
+	"testing"
+)
+
+func TestOncePer_Once(t *testing.T) {
+	once := OncePer{}
+	key := NewOnceKey("key")
+
+	a := once.Once(key, func() interface{} { return "a" }).(string)
+	b := once.Once(key, func() interface{} { return "b" }).(string)
+
+	if a != "a" {
+		t.Errorf(`first call to Once should return "a": %q`, a)
+	}
+
+	if b != "a" {
+		t.Errorf(`second call to Once with the same key should return "a": %q`, b)
+	}
+}
+
+func TestOncePer_Get(t *testing.T) {
+	once := OncePer{}
+	key := NewOnceKey("key")
+
+	a := once.Once(key, func() interface{} { return "a" }).(string)
+	b := once.Get(key).(string)
+
+	if a != "a" {
+		t.Errorf(`first call to Once should return "a": %q`, a)
+	}
+
+	if b != "a" {
+		t.Errorf(`Get with the same key should return "a": %q`, b)
+	}
+}
+
+func TestOncePer_Get_panic(t *testing.T) {
+	once := OncePer{}
+	key := NewOnceKey("key")
+
+	defer func() {
+		p := recover()
+
+		if p == nil {
+			t.Error("call to Get for unused key should panic")
+		}
+	}()
+
+	once.Get(key)
+}
+
+func TestOncePer_OnceStringSlice(t *testing.T) {
+	once := OncePer{}
+	key := NewOnceKey("key")
+
+	a := once.OnceStringSlice(key, func() []string { return []string{"a"} })
+	b := once.OnceStringSlice(key, func() []string { return []string{"a"} })
+
+	if a[0] != "a" {
+		t.Errorf(`first call to OnceStringSlice should return ["a"]: %q`, a)
+	}
+
+	if b[0] != "a" {
+		t.Errorf(`second call to OnceStringSlice with the same key should return ["a"]: %q`, b)
+	}
+}
+
+func TestOncePer_Once2StringSlice(t *testing.T) {
+	once := OncePer{}
+	key := NewOnceKey("key")
+
+	a, b := once.Once2StringSlice(key, func() ([]string, []string) { return []string{"a"}, []string{"b"} })
+	c, d := once.Once2StringSlice(key, func() ([]string, []string) { return []string{"c"}, []string{"d"} })
+
+	if a[0] != "a" || b[0] != "b" {
+		t.Errorf(`first call to Once2StringSlice should return ["a"], ["b"]: %q, %q`, a, b)
+	}
+
+	if c[0] != "a" || d[0] != "b" {
+		t.Errorf(`second call to Once2StringSlice with the same key should return ["a"], ["b"]: %q, %q`, c, d)
+	}
+}
+
+func TestNewOnceKey(t *testing.T) {
+	once := OncePer{}
+	key1 := NewOnceKey("key")
+	key2 := NewOnceKey("key")
+
+	a := once.Once(key1, func() interface{} { return "a" }).(string)
+	b := once.Once(key2, func() interface{} { return "b" }).(string)
+
+	if a != "a" {
+		t.Errorf(`first call to Once should return "a": %q`, a)
+	}
+
+	if b != "b" {
+		t.Errorf(`second call to Once with the NewOnceKey from same string should return "b": %q`, b)
+	}
+}
+
+func TestNewCustomOnceKey(t *testing.T) {
+	type key struct {
+		key string
+	}
+	once := OncePer{}
+	key1 := NewCustomOnceKey(key{"key"})
+	key2 := NewCustomOnceKey(key{"key"})
+
+	a := once.Once(key1, func() interface{} { return "a" }).(string)
+	b := once.Once(key2, func() interface{} { return "b" }).(string)
+
+	if a != "a" {
+		t.Errorf(`first call to Once should return "a": %q`, a)
+	}
+
+	if b != "a" {
+		t.Errorf(`second call to Once with the NewCustomOnceKey from equal key should return "a": %q`, b)
+	}
+}
diff --git a/android/rule_builder.go b/android/rule_builder.go
new file mode 100644
index 0000000..d005839
--- /dev/null
+++ b/android/rule_builder.go
@@ -0,0 +1,395 @@
+// Copyright 2018 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package android
+
+import (
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/google/blueprint"
+	"github.com/google/blueprint/proptools"
+)
+
+// RuleBuilder provides an alternative to ModuleContext.Rule and ModuleContext.Build to add a command line to the build
+// graph.
+type RuleBuilder struct {
+	commands       []*RuleBuilderCommand
+	installs       []RuleBuilderInstall
+	temporariesSet map[string]bool
+	restat         bool
+}
+
+// NewRuleBuilder returns a newly created RuleBuilder.
+func NewRuleBuilder() *RuleBuilder {
+	return &RuleBuilder{
+		temporariesSet: make(map[string]bool),
+	}
+}
+
+// RuleBuilderInstall is a tuple of install from and to locations.
+type RuleBuilderInstall struct {
+	From, To string
+}
+
+// Restat marks the rule as a restat rule, which will be passed to ModuleContext.Rule in BuildParams.Restat.
+func (r *RuleBuilder) Restat() *RuleBuilder {
+	r.restat = true
+	return r
+}
+
+// Install associates an output of the rule with an install location, which can be retrieved later using
+// RuleBuilder.Installs.
+func (r *RuleBuilder) Install(from, to string) {
+	r.installs = append(r.installs, RuleBuilderInstall{from, to})
+}
+
+// Command returns a new RuleBuilderCommand for the rule.  The commands will be ordered in the rule by when they were
+// created by this method.  That can be mutated through their methods in any order, as long as the mutations do not
+// race with any call to Build.
+func (r *RuleBuilder) Command() *RuleBuilderCommand {
+	command := &RuleBuilderCommand{}
+	r.commands = append(r.commands, command)
+	return command
+}
+
+// Temporary marks an output of a command as an intermediate file that will be used as an input to another command
+// in the same rule, and should not be listed in Outputs.
+func (r *RuleBuilder) Temporary(path string) {
+	r.temporariesSet[path] = true
+}
+
+// DeleteTemporaryFiles adds a command to the rule that deletes any outputs that have been marked using Temporary
+// when the rule runs.  DeleteTemporaryFiles should be called after all calls to Temporary.
+func (r *RuleBuilder) DeleteTemporaryFiles() {
+	var temporariesList []string
+
+	for intermediate := range r.temporariesSet {
+		temporariesList = append(temporariesList, intermediate)
+	}
+	sort.Strings(temporariesList)
+
+	r.Command().Text("rm").Flag("-f").Outputs(temporariesList)
+}
+
+// Inputs returns the list of paths that were passed to the RuleBuilderCommand methods that take input paths, such
+// as RuleBuilderCommand.Input, RuleBuilderComand.Implicit, or RuleBuilderCommand.FlagWithInput.  Inputs to a command
+// that are also outputs of another command in the same RuleBuilder are filtered out.
+func (r *RuleBuilder) Inputs() []string {
+	outputs := r.outputSet()
+
+	inputs := make(map[string]bool)
+	for _, c := range r.commands {
+		for _, input := range c.inputs {
+			if !outputs[input] {
+				inputs[input] = true
+			}
+		}
+	}
+
+	var inputList []string
+	for input := range inputs {
+		inputList = append(inputList, input)
+	}
+	sort.Strings(inputList)
+
+	return inputList
+}
+
+func (r *RuleBuilder) outputSet() map[string]bool {
+	outputs := make(map[string]bool)
+	for _, c := range r.commands {
+		for _, output := range c.outputs {
+			outputs[output] = true
+		}
+	}
+	return outputs
+}
+
+// Outputs returns the list of paths that were passed to the RuleBuilderCommand methods that take output paths, such
+// as RuleBuilderCommand.Output, RuleBuilderCommand.ImplicitOutput, or RuleBuilderCommand.FlagWithInput.
+func (r *RuleBuilder) Outputs() []string {
+	outputs := r.outputSet()
+
+	var outputList []string
+	for output := range outputs {
+		if !r.temporariesSet[output] {
+			outputList = append(outputList, output)
+		}
+	}
+	sort.Strings(outputList)
+	return outputList
+}
+
+// Installs returns the list of tuples passed to Install.
+func (r *RuleBuilder) Installs() []RuleBuilderInstall {
+	return append([]RuleBuilderInstall(nil), r.installs...)
+}
+
+func (r *RuleBuilder) toolsSet() map[string]bool {
+	tools := make(map[string]bool)
+	for _, c := range r.commands {
+		for _, tool := range c.tools {
+			tools[tool] = true
+		}
+	}
+
+	return tools
+}
+
+// Tools returns the list of paths that were passed to the RuleBuilderCommand.Tool method.
+func (r *RuleBuilder) Tools() []string {
+	toolsSet := r.toolsSet()
+
+	var toolsList []string
+	for tool := range toolsSet {
+		toolsList = append(toolsList, tool)
+	}
+	sort.Strings(toolsList)
+	return toolsList
+}
+
+// Commands returns a slice containing a the built command line for each call to RuleBuilder.Command.
+func (r *RuleBuilder) Commands() []string {
+	var commands []string
+	for _, c := range r.commands {
+		commands = append(commands, string(c.buf))
+	}
+	return commands
+}
+
+// BuilderContext is a subset of ModuleContext and SingletonContext.
+type BuilderContext interface {
+	PathContext
+	Rule(PackageContext, string, blueprint.RuleParams, ...string) blueprint.Rule
+	Build(PackageContext, BuildParams)
+}
+
+var _ BuilderContext = ModuleContext(nil)
+var _ BuilderContext = SingletonContext(nil)
+
+// Build adds the built command line to the build graph, with dependencies on Inputs and Tools, and output files for
+// Outputs.
+func (r *RuleBuilder) Build(pctx PackageContext, ctx BuilderContext, name string, desc string) {
+	// TODO: convert RuleBuilder arguments and storage to Paths
+	mctx, _ := ctx.(ModuleContext)
+	var inputs Paths
+	for _, input := range r.Inputs() {
+		// Module output paths
+		if mctx != nil {
+			rel, isRel := MaybeRel(ctx, PathForModuleOut(mctx).String(), input)
+			if isRel {
+				inputs = append(inputs, PathForModuleOut(mctx, rel))
+				continue
+			}
+		}
+
+		// Other output paths
+		rel, isRel := MaybeRel(ctx, PathForOutput(ctx).String(), input)
+		if isRel {
+			inputs = append(inputs, PathForOutput(ctx, rel))
+			continue
+		}
+
+		// TODO: remove this once boot image is moved to where PathForOutput can find it.
+		inputs = append(inputs, &unknownRulePath{input})
+	}
+
+	var outputs WritablePaths
+	for _, output := range r.Outputs() {
+		if mctx != nil {
+			rel := Rel(ctx, PathForModuleOut(mctx).String(), output)
+			outputs = append(outputs, PathForModuleOut(mctx, rel))
+		} else {
+			rel := Rel(ctx, PathForOutput(ctx).String(), output)
+			outputs = append(outputs, PathForOutput(ctx, rel))
+		}
+	}
+
+	if len(r.Commands()) > 0 {
+		ctx.Build(pctx, BuildParams{
+			Rule: ctx.Rule(pctx, name, blueprint.RuleParams{
+				Command:     strings.Join(proptools.NinjaEscape(r.Commands()), " && "),
+				CommandDeps: r.Tools(),
+			}),
+			Implicits:   inputs,
+			Outputs:     outputs,
+			Description: desc,
+		})
+	}
+}
+
+// RuleBuilderCommand is a builder for a command in a command line.  It can be mutated by its methods to add to the
+// command and track dependencies.  The methods mutate the RuleBuilderCommand in place, as well as return the
+// RuleBuilderCommand, so they can be used chained or unchained.  All methods that add text implicitly add a single
+// space as a separator from the previous method.
+type RuleBuilderCommand struct {
+	buf     []byte
+	inputs  []string
+	outputs []string
+	tools   []string
+}
+
+// Text adds the specified raw text to the command line.  The text should not contain input or output paths or the
+// rule will not have them listed in its dependencies or outputs.
+func (c *RuleBuilderCommand) Text(text string) *RuleBuilderCommand {
+	if len(c.buf) > 0 {
+		c.buf = append(c.buf, ' ')
+	}
+	c.buf = append(c.buf, text...)
+	return c
+}
+
+// Textf adds the specified formatted text to the command line.  The text should not contain input or output paths or
+// the rule will not have them listed in its dependencies or outputs.
+func (c *RuleBuilderCommand) Textf(format string, a ...interface{}) *RuleBuilderCommand {
+	return c.Text(fmt.Sprintf(format, a...))
+}
+
+// Flag adds the specified raw text to the command line.  The text should not contain input or output paths or the
+// rule will not have them listed in its dependencies or outputs.
+func (c *RuleBuilderCommand) Flag(flag string) *RuleBuilderCommand {
+	return c.Text(flag)
+}
+
+// FlagWithArg adds the specified flag and argument text to the command line, with no separator between them.  The flag
+// and argument should not contain input or output paths or the rule will not have them listed in its dependencies or
+// outputs.
+func (c *RuleBuilderCommand) FlagWithArg(flag, arg string) *RuleBuilderCommand {
+	return c.Text(flag + arg)
+}
+
+// FlagWithArg adds the specified flag and list of arguments to the command line, with the arguments joined by sep
+// and no separator between the flag and arguments.  The flag and arguments should not contain input or output paths or
+// the rule will not have them listed in its dependencies or outputs.
+func (c *RuleBuilderCommand) FlagWithList(flag string, list []string, sep string) *RuleBuilderCommand {
+	return c.Text(flag + strings.Join(list, sep))
+}
+
+// Tool adds the specified tool path to the command line.  The path will be also added to the dependencies returned by
+// RuleBuilder.Tools.
+func (c *RuleBuilderCommand) Tool(path string) *RuleBuilderCommand {
+	c.tools = append(c.tools, path)
+	return c.Text(path)
+}
+
+// Input adds the specified input path to the command line.  The path will also be added to the dependencies returned by
+// RuleBuilder.Inputs.
+func (c *RuleBuilderCommand) Input(path string) *RuleBuilderCommand {
+	c.inputs = append(c.inputs, path)
+	return c.Text(path)
+}
+
+// Inputs adds the specified input paths to the command line, separated by spaces.  The paths will also be added to the
+// dependencies returned by RuleBuilder.Inputs.
+func (c *RuleBuilderCommand) Inputs(paths []string) *RuleBuilderCommand {
+	for _, path := range paths {
+		c.Input(path)
+	}
+	return c
+}
+
+// Implicit adds the specified input path to the dependencies returned by RuleBuilder.Inputs without modifying the
+// command line.
+func (c *RuleBuilderCommand) Implicit(path string) *RuleBuilderCommand {
+	c.inputs = append(c.inputs, path)
+	return c
+}
+
+// Implicits adds the specified input paths to the dependencies returned by RuleBuilder.Inputs without modifying the
+// command line.
+func (c *RuleBuilderCommand) Implicits(paths []string) *RuleBuilderCommand {
+	c.inputs = append(c.inputs, paths...)
+	return c
+}
+
+// Output adds the specified output path to the command line.  The path will also be added to the outputs returned by
+// RuleBuilder.Outputs.
+func (c *RuleBuilderCommand) Output(path string) *RuleBuilderCommand {
+	c.outputs = append(c.outputs, path)
+	return c.Text(path)
+}
+
+// Outputs adds the specified output paths to the command line, separated by spaces.  The paths will also be added to
+// the outputs returned by RuleBuilder.Outputs.
+func (c *RuleBuilderCommand) Outputs(paths []string) *RuleBuilderCommand {
+	for _, path := range paths {
+		c.Output(path)
+	}
+	return c
+}
+
+// ImplicitOutput adds the specified output path to the dependencies returned by RuleBuilder.Outputs without modifying
+// the command line.
+func (c *RuleBuilderCommand) ImplicitOutput(path string) *RuleBuilderCommand {
+	c.outputs = append(c.outputs, path)
+	return c
+}
+
+// ImplicitOutputs adds the specified output paths to the dependencies returned by RuleBuilder.Outputs without modifying
+// the command line.
+func (c *RuleBuilderCommand) ImplicitOutputs(paths []string) *RuleBuilderCommand {
+	c.outputs = append(c.outputs, paths...)
+	return c
+}
+
+// FlagWithInput adds the specified flag and input path to the command line, with no separator between them.  The path
+// will also be added to the dependencies returned by RuleBuilder.Inputs.
+func (c *RuleBuilderCommand) FlagWithInput(flag, path string) *RuleBuilderCommand {
+	c.inputs = append(c.inputs, path)
+	return c.Text(flag + path)
+}
+
+// FlagWithInputList adds the specified flag and input paths to the command line, with the inputs joined by sep
+// and no separator between the flag and inputs.  The input paths will also be added to the dependencies returned by
+// RuleBuilder.Inputs.
+func (c *RuleBuilderCommand) FlagWithInputList(flag string, paths []string, sep string) *RuleBuilderCommand {
+	c.inputs = append(c.inputs, paths...)
+	return c.FlagWithList(flag, paths, sep)
+}
+
+// FlagForEachInput adds the specified flag joined with each input path to the command line.  The input paths will also
+// be added to the dependencies returned by RuleBuilder.Inputs.  The result is identical to calling FlagWithInput for
+// each input path.
+func (c *RuleBuilderCommand) FlagForEachInput(flag string, paths []string) *RuleBuilderCommand {
+	for _, path := range paths {
+		c.FlagWithInput(flag, path)
+	}
+	return c
+}
+
+// FlagWithOutput adds the specified flag and output path to the command line, with no separator between them.  The path
+// will also be added to the outputs returned by RuleBuilder.Outputs.
+func (c *RuleBuilderCommand) FlagWithOutput(flag, path string) *RuleBuilderCommand {
+	c.outputs = append(c.outputs, path)
+	return c.Text(flag + path)
+}
+
+// String returns the command line.
+func (c *RuleBuilderCommand) String() string {
+	return string(c.buf)
+}
+
+type unknownRulePath struct {
+	path string
+}
+
+var _ Path = (*unknownRulePath)(nil)
+
+func (p *unknownRulePath) String() string { return p.path }
+func (p *unknownRulePath) Ext() string    { return filepath.Ext(p.path) }
+func (p *unknownRulePath) Base() string   { return filepath.Base(p.path) }
+func (p *unknownRulePath) Rel() string    { return p.path }
diff --git a/android/rule_builder_test.go b/android/rule_builder_test.go
new file mode 100644
index 0000000..f7577a6
--- /dev/null
+++ b/android/rule_builder_test.go
@@ -0,0 +1,292 @@
+// Copyright 2019 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package android
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func ExampleRuleBuilder() {
+	rule := NewRuleBuilder()
+
+	rule.Command().Tool("ld").Inputs([]string{"a.o", "b.o"}).FlagWithOutput("-o ", "linked")
+	rule.Command().Text("echo success")
+
+	// To add the command to the build graph:
+	// rule.Build(pctx, ctx, "link", "link")
+
+	fmt.Printf("commands: %q\n", strings.Join(rule.Commands(), " && "))
+	fmt.Printf("tools: %q\n", rule.Tools())
+	fmt.Printf("inputs: %q\n", rule.Inputs())
+	fmt.Printf("outputs: %q\n", rule.Outputs())
+
+	// Output:
+	// commands: "ld a.o b.o -o linked && echo success"
+	// tools: ["ld"]
+	// inputs: ["a.o" "b.o"]
+	// outputs: ["linked"]
+}
+
+func ExampleRuleBuilder_Temporary() {
+	rule := NewRuleBuilder()
+
+	rule.Command().Tool("cp").Input("a").Output("b")
+	rule.Command().Tool("cp").Input("b").Output("c")
+	rule.Temporary("b")
+
+	fmt.Printf("commands: %q\n", strings.Join(rule.Commands(), " && "))
+	fmt.Printf("tools: %q\n", rule.Tools())
+	fmt.Printf("inputs: %q\n", rule.Inputs())
+	fmt.Printf("outputs: %q\n", rule.Outputs())
+
+	// Output:
+	// commands: "cp a b && cp b c"
+	// tools: ["cp"]
+	// inputs: ["a"]
+	// outputs: ["c"]
+}
+
+func ExampleRuleBuilder_DeleteTemporaryFiles() {
+	rule := NewRuleBuilder()
+
+	rule.Command().Tool("cp").Input("a").Output("b")
+	rule.Command().Tool("cp").Input("b").Output("c")
+	rule.Temporary("b")
+	rule.DeleteTemporaryFiles()
+
+	fmt.Printf("commands: %q\n", strings.Join(rule.Commands(), " && "))
+	fmt.Printf("tools: %q\n", rule.Tools())
+	fmt.Printf("inputs: %q\n", rule.Inputs())
+	fmt.Printf("outputs: %q\n", rule.Outputs())
+
+	// Output:
+	// commands: "cp a b && cp b c && rm -f b"
+	// tools: ["cp"]
+	// inputs: ["a"]
+	// outputs: ["c"]
+}
+
+func ExampleRuleBuilderCommand() {
+	rule := NewRuleBuilder()
+
+	// chained
+	rule.Command().Tool("ld").Inputs([]string{"a.o", "b.o"}).FlagWithOutput("-o ", "linked")
+
+	// unchained
+	cmd := rule.Command()
+	cmd.Tool("ld")
+	cmd.Inputs([]string{"a.o", "b.o"})
+	cmd.FlagWithOutput("-o ", "linked")
+
+	// mixed:
+	cmd = rule.Command().Tool("ld")
+	cmd.Inputs([]string{"a.o", "b.o"})
+	cmd.FlagWithOutput("-o ", "linked")
+}
+
+func ExampleRuleBuilderCommand_Flag() {
+	fmt.Println(NewRuleBuilder().Command().
+		Tool("ls").Flag("-l"))
+	// Output:
+	// ls -l
+}
+
+func ExampleRuleBuilderCommand_FlagWithArg() {
+	fmt.Println(NewRuleBuilder().Command().
+		Tool("ls").
+		FlagWithArg("--sort=", "time"))
+	// Output:
+	// ls --sort=time
+}
+
+func ExampleRuleBuilderCommand_FlagForEachInput() {
+	fmt.Println(NewRuleBuilder().Command().
+		Tool("turbine").
+		FlagForEachInput("--classpath ", []string{"a.jar", "b.jar"}))
+	// Output:
+	// turbine --classpath a.jar --classpath b.jar
+}
+
+func ExampleRuleBuilderCommand_FlagWithInputList() {
+	fmt.Println(NewRuleBuilder().Command().
+		Tool("java").
+		FlagWithInputList("-classpath=", []string{"a.jar", "b.jar"}, ":"))
+	// Output:
+	// java -classpath=a.jar:b.jar
+}
+
+func ExampleRuleBuilderCommand_FlagWithInput() {
+	fmt.Println(NewRuleBuilder().Command().
+		Tool("java").
+		FlagWithInput("-classpath=", "a"))
+	// Output:
+	// java -classpath=a
+}
+
+func ExampleRuleBuilderCommand_FlagWithList() {
+	fmt.Println(NewRuleBuilder().Command().
+		Tool("ls").
+		FlagWithList("--sort=", []string{"time", "size"}, ","))
+	// Output:
+	// ls --sort=time,size
+}
+
+func TestRuleBuilder(t *testing.T) {
+	rule := NewRuleBuilder()
+
+	cmd := rule.Command().
+		Flag("Flag").
+		FlagWithArg("FlagWithArg=", "arg").
+		FlagWithInput("FlagWithInput=", "input").
+		FlagWithOutput("FlagWithOutput=", "output").
+		Implicit("Implicit").
+		ImplicitOutput("ImplicitOutput").
+		Input("Input").
+		Output("Output").
+		Text("Text").
+		Tool("Tool")
+
+	rule.Command().
+		Text("command2").
+		Input("input2").
+		Output("output2").
+		Tool("tool2")
+
+	// Test updates to the first command after the second command has been started
+	cmd.Text("after command2")
+	// Test updating a command when the previous update did not replace the cmd variable
+	cmd.Text("old cmd")
+
+	// Test a command that uses the output of a previous command as an input
+	rule.Command().
+		Text("command3").
+		Input("input3").
+		Input("output2").
+		Output("output3")
+
+	wantCommands := []string{
+		"Flag FlagWithArg=arg FlagWithInput=input FlagWithOutput=output Input Output Text Tool after command2 old cmd",
+		"command2 input2 output2 tool2",
+		"command3 input3 output2 output3",
+	}
+	wantInputs := []string{"Implicit", "Input", "input", "input2", "input3"}
+	wantOutputs := []string{"ImplicitOutput", "Output", "output", "output2", "output3"}
+	wantTools := []string{"Tool", "tool2"}
+
+	if !reflect.DeepEqual(rule.Commands(), wantCommands) {
+		t.Errorf("\nwant rule.Commands() = %#v\n                   got %#v", wantCommands, rule.Commands())
+	}
+	if !reflect.DeepEqual(rule.Inputs(), wantInputs) {
+		t.Errorf("\nwant rule.Inputs() = %#v\n                 got %#v", wantInputs, rule.Inputs())
+	}
+	if !reflect.DeepEqual(rule.Outputs(), wantOutputs) {
+		t.Errorf("\nwant rule.Outputs() = %#v\n                  got %#v", wantOutputs, rule.Outputs())
+	}
+	if !reflect.DeepEqual(rule.Tools(), wantTools) {
+		t.Errorf("\nwant rule.Tools() = %#v\n                got %#v", wantTools, rule.Tools())
+	}
+}
+
+func testRuleBuilderFactory() Module {
+	module := &testRuleBuilderModule{}
+	module.AddProperties(&module.properties)
+	InitAndroidModule(module)
+	return module
+}
+
+type testRuleBuilderModule struct {
+	ModuleBase
+	properties struct {
+		Src string
+	}
+}
+
+func (t *testRuleBuilderModule) GenerateAndroidBuildActions(ctx ModuleContext) {
+	in := PathForSource(ctx, t.properties.Src)
+	out := PathForModuleOut(ctx, ctx.ModuleName())
+
+	testRuleBuilder_Build(ctx, in, out)
+}
+
+type testRuleBuilderSingleton struct{}
+
+func testRuleBuilderSingletonFactory() Singleton {
+	return &testRuleBuilderSingleton{}
+}
+
+func (t *testRuleBuilderSingleton) GenerateBuildActions(ctx SingletonContext) {
+	in := PathForSource(ctx, "bar")
+	out := PathForOutput(ctx, "baz")
+	testRuleBuilder_Build(ctx, in, out)
+}
+
+func testRuleBuilder_Build(ctx BuilderContext, in Path, out WritablePath) {
+	rule := NewRuleBuilder()
+
+	rule.Command().Tool("cp").Input(in.String()).Output(out.String())
+
+	rule.Build(pctx, ctx, "rule", "desc")
+}
+
+func TestRuleBuilder_Build(t *testing.T) {
+	buildDir, err := ioutil.TempDir("", "soong_test_rule_builder")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(buildDir)
+
+	bp := `
+		rule_builder_test {
+			name: "foo",
+			src: "bar",
+		}
+	`
+
+	config := TestConfig(buildDir, nil)
+	ctx := NewTestContext()
+	ctx.MockFileSystem(map[string][]byte{
+		"Android.bp": []byte(bp),
+		"bar":        nil,
+		"cp":         nil,
+	})
+	ctx.RegisterModuleType("rule_builder_test", ModuleFactoryAdaptor(testRuleBuilderFactory))
+	ctx.RegisterSingletonType("rule_builder_test", SingletonFactoryAdaptor(testRuleBuilderSingletonFactory))
+	ctx.Register()
+
+	_, errs := ctx.ParseFileList(".", []string{"Android.bp"})
+	FailIfErrored(t, errs)
+	_, errs = ctx.PrepareBuildActions(config)
+	FailIfErrored(t, errs)
+
+	foo := ctx.ModuleForTests("foo", "").Rule("rule")
+
+	// TODO: make RuleParams accessible to tests and verify rule.Command().Tools() ends up in CommandDeps
+
+	if len(foo.Implicits) != 1 || foo.Implicits[0].String() != "bar" {
+		t.Errorf("want foo.Implicits = [%q], got %q", "bar", foo.Implicits.Strings())
+	}
+
+	wantOutput := filepath.Join(buildDir, ".intermediates", "foo", "foo")
+	if len(foo.Outputs) != 1 || foo.Outputs[0].String() != wantOutput {
+		t.Errorf("want foo.Outputs = [%q], got %q", wantOutput, foo.Outputs.Strings())
+	}
+
+}
diff --git a/android/variable.go b/android/variable.go
index 0904cea..f38cf25 100644
--- a/android/variable.go
+++ b/android/variable.go
@@ -213,6 +213,8 @@
 	CFIExcludePaths []string `json:",omitempty"`
 	CFIIncludePaths []string `json:",omitempty"`
 
+	DisableScudo *bool `json:",omitempty"`
+
 	EnableXOM       *bool    `json:",omitempty"`
 	XOMExcludePaths []string `json:",omitempty"`
 
diff --git a/apex/apex.go b/apex/apex.go
index f6daf9b..3584896 100644
--- a/apex/apex.go
+++ b/apex/apex.go
@@ -274,6 +274,7 @@
 	etc apexFileClass = iota
 	nativeSharedLib
 	nativeExecutable
+	shBinary
 	javaSharedLib
 )
 
@@ -333,7 +334,7 @@
 		return "ETC"
 	case nativeSharedLib:
 		return "SHARED_LIBRARIES"
-	case nativeExecutable:
+	case nativeExecutable, shBinary:
 		return "EXECUTABLES"
 	case javaSharedLib:
 		return "JAVA_LIBRARIES"
@@ -484,17 +485,15 @@
 		{Mutator: "arch", Variation: "android_common"},
 	}, javaLibTag, a.properties.Java_libs...)
 
-	if !ctx.Config().FlattenApex() || ctx.Config().UnbundledBuild() {
-		if String(a.properties.Key) == "" {
-			ctx.ModuleErrorf("key is missing")
-			return
-		}
-		ctx.AddDependency(ctx.Module(), keyTag, String(a.properties.Key))
+	if String(a.properties.Key) == "" {
+		ctx.ModuleErrorf("key is missing")
+		return
+	}
+	ctx.AddDependency(ctx.Module(), keyTag, String(a.properties.Key))
 
-		cert := android.SrcIsModule(String(a.properties.Certificate))
-		if cert != "" {
-			ctx.AddDependency(ctx.Module(), certificateTag, cert)
-		}
+	cert := android.SrcIsModule(String(a.properties.Certificate))
+	if cert != "" {
+		ctx.AddDependency(ctx.Module(), certificateTag, cert)
 	}
 }
 
@@ -540,6 +539,7 @@
 	case "lib64":
 		dirInApex = "lib64"
 	}
+	dirInApex = filepath.Join(dirInApex, cc.RelativeInstallPath())
 	if !cc.Arch().Native {
 		dirInApex = filepath.Join(dirInApex, cc.Arch().ArchType.String())
 	}
@@ -564,11 +564,19 @@
 }
 
 func getCopyManifestForExecutable(cc *cc.Module) (fileToCopy android.Path, dirInApex string) {
+	// TODO(b/123721777) respect relative_install_path also for binaries
+	// dirInApex = filepath.Join("bin", cc.RelativeInstallPath())
 	dirInApex = "bin"
 	fileToCopy = cc.OutputFile().Path()
 	return
 }
 
+func getCopyManifestForShBinary(sh *android.ShBinary) (fileToCopy android.Path, dirInApex string) {
+	dirInApex = filepath.Join("bin", sh.SubDir())
+	fileToCopy = sh.OutputFile()
+	return
+}
+
 func getCopyManifestForJavaLibrary(java *java.Library) (fileToCopy android.Path, dirInApex string) {
 	dirInApex = "javalib"
 	fileToCopy = java.DexJarFile()
@@ -625,8 +633,11 @@
 					fileToCopy, dirInApex := getCopyManifestForExecutable(cc)
 					filesInfo = append(filesInfo, apexFile{fileToCopy, depName, dirInApex, nativeExecutable, cc, cc.Symlinks()})
 					return true
+				} else if sh, ok := child.(*android.ShBinary); ok {
+					fileToCopy, dirInApex := getCopyManifestForShBinary(sh)
+					filesInfo = append(filesInfo, apexFile{fileToCopy, depName, dirInApex, shBinary, sh, nil})
 				} else {
-					ctx.PropertyErrorf("binaries", "%q is not a cc_binary module", depName)
+					ctx.PropertyErrorf("binaries", "%q is neithher cc_binary nor sh_binary", depName)
 				}
 			case javaLibTag:
 				if java, ok := child.(*java.Library); ok {
@@ -687,7 +698,7 @@
 	})
 
 	a.flattened = ctx.Config().FlattenApex() && !ctx.Config().UnbundledBuild()
-	if !a.flattened && keyFile == nil {
+	if keyFile == nil {
 		ctx.PropertyErrorf("key", "private_key for %q could not be found", String(a.properties.Key))
 		return
 	}
@@ -724,11 +735,12 @@
 		a.buildUnflattenedApex(ctx, keyFile, pubKeyFile, certificate, zipApex)
 	}
 	if a.apexTypes.image() {
-		if ctx.Config().FlattenApex() {
-			a.buildFlattenedApex(ctx)
-		} else {
-			a.buildUnflattenedApex(ctx, keyFile, pubKeyFile, certificate, imageApex)
-		}
+		// Build rule for unflattened APEX is created even when ctx.Config().FlattenApex()
+		// is true. This is to support referencing APEX via ":<module_name" syntax
+		// in other modules. It is in AndroidMk where the selection of flattened
+		// or unflattened APEX is made.
+		a.buildUnflattenedApex(ctx, keyFile, pubKeyFile, certificate, imageApex)
+		a.buildFlattenedApex(ctx)
 	}
 }
 
@@ -907,7 +919,7 @@
 	})
 
 	// Install to $OUT/soong/{target,host}/.../apex
-	if a.installable() {
+	if a.installable() && !ctx.Config().FlattenApex() {
 		ctx.InstallFile(android.PathForModuleInstall(ctx, "apex"), ctx.ModuleName()+suffix, a.outputFiles[apexType])
 	}
 }
@@ -927,9 +939,11 @@
 		})
 		a.filesInfo = append(a.filesInfo, apexFile{copiedManifest, ctx.ModuleName() + ".apex_manifest.json", ".", etc, nil, nil})
 
-		for _, fi := range a.filesInfo {
-			dir := filepath.Join("apex", ctx.ModuleName(), fi.installDir)
-			ctx.InstallFile(android.PathForModuleInstall(ctx, dir), fi.builtFile.Base(), fi.builtFile)
+		if ctx.Config().FlattenApex() {
+			for _, fi := range a.filesInfo {
+				dir := filepath.Join("apex", ctx.ModuleName(), fi.installDir)
+				ctx.InstallFile(android.PathForModuleInstall(ctx, dir), fi.builtFile.Base(), fi.builtFile)
+			}
 		}
 	}
 }
@@ -950,91 +964,99 @@
 		}}
 }
 
+func (a *apexBundle) androidMkForFiles(w io.Writer, name, moduleDir string) []string {
+	moduleNames := []string{}
+
+	for _, fi := range a.filesInfo {
+		if cc, ok := fi.module.(*cc.Module); ok && cc.Properties.HideFromMake {
+			continue
+		}
+		if !android.InList(fi.moduleName, moduleNames) {
+			moduleNames = append(moduleNames, fi.moduleName)
+		}
+		fmt.Fprintln(w, "\ninclude $(CLEAR_VARS)")
+		fmt.Fprintln(w, "LOCAL_PATH :=", moduleDir)
+		fmt.Fprintln(w, "LOCAL_MODULE :=", fi.moduleName)
+		if a.flattened {
+			// /system/apex/<name>/{lib|framework|...}
+			fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", filepath.Join("$(OUT_DIR)",
+				a.installDir.RelPathString(), name, fi.installDir))
+		} else {
+			// /apex/<name>/{lib|framework|...}
+			fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", filepath.Join("$(PRODUCT_OUT)",
+				"apex", name, fi.installDir))
+		}
+		fmt.Fprintln(w, "LOCAL_PREBUILT_MODULE_FILE :=", fi.builtFile.String())
+		fmt.Fprintln(w, "LOCAL_MODULE_CLASS :=", fi.class.NameInMake())
+		if fi.module != nil {
+			archStr := fi.module.Target().Arch.ArchType.String()
+			host := false
+			switch fi.module.Target().Os.Class {
+			case android.Host:
+				if archStr != "common" {
+					fmt.Fprintln(w, "LOCAL_MODULE_HOST_ARCH :=", archStr)
+				}
+				host = true
+			case android.HostCross:
+				if archStr != "common" {
+					fmt.Fprintln(w, "LOCAL_MODULE_HOST_CROSS_ARCH :=", archStr)
+				}
+				host = true
+			case android.Device:
+				if archStr != "common" {
+					fmt.Fprintln(w, "LOCAL_MODULE_TARGET_ARCH :=", archStr)
+				}
+			}
+			if host {
+				makeOs := fi.module.Target().Os.String()
+				if fi.module.Target().Os == android.Linux || fi.module.Target().Os == android.LinuxBionic {
+					makeOs = "linux"
+				}
+				fmt.Fprintln(w, "LOCAL_MODULE_HOST_OS :=", makeOs)
+				fmt.Fprintln(w, "LOCAL_IS_HOST_MODULE := true")
+			}
+		}
+		if fi.class == javaSharedLib {
+			javaModule := fi.module.(*java.Library)
+			// soong_java_prebuilt.mk sets LOCAL_MODULE_SUFFIX := .jar  Therefore
+			// we need to remove the suffix from LOCAL_MODULE_STEM, otherwise
+			// we will have foo.jar.jar
+			fmt.Fprintln(w, "LOCAL_MODULE_STEM :=", strings.TrimSuffix(fi.builtFile.Base(), ".jar"))
+			fmt.Fprintln(w, "LOCAL_SOONG_CLASSES_JAR :=", javaModule.ImplementationAndResourcesJars()[0].String())
+			fmt.Fprintln(w, "LOCAL_SOONG_HEADER_JAR :=", javaModule.HeaderJars()[0].String())
+			fmt.Fprintln(w, "LOCAL_SOONG_DEX_JAR :=", fi.builtFile.String())
+			fmt.Fprintln(w, "LOCAL_DEX_PREOPT := false")
+			fmt.Fprintln(w, "include $(BUILD_SYSTEM)/soong_java_prebuilt.mk")
+		} else if fi.class == nativeSharedLib || fi.class == nativeExecutable {
+			fmt.Fprintln(w, "LOCAL_MODULE_STEM :=", fi.builtFile.Base())
+			if cc, ok := fi.module.(*cc.Module); ok && cc.UnstrippedOutputFile() != nil {
+				fmt.Fprintln(w, "LOCAL_SOONG_UNSTRIPPED_BINARY :=", cc.UnstrippedOutputFile().String())
+			}
+			fmt.Fprintln(w, "include $(BUILD_SYSTEM)/soong_cc_prebuilt.mk")
+		} else {
+			fmt.Fprintln(w, "LOCAL_MODULE_STEM :=", fi.builtFile.Base())
+			fmt.Fprintln(w, "include $(BUILD_PREBUILT)")
+		}
+	}
+	return moduleNames
+}
+
 func (a *apexBundle) androidMkForType(apexType apexPackaging) android.AndroidMkData {
 	return android.AndroidMkData{
 		Custom: func(w io.Writer, name, prefix, moduleDir string, data android.AndroidMkData) {
 			moduleNames := []string{}
-			for _, fi := range a.filesInfo {
-				if !android.InList(fi.moduleName, moduleNames) {
-					moduleNames = append(moduleNames, fi.moduleName)
-				}
+			if a.installable() {
+				a.androidMkForFiles(w, name, moduleDir)
 			}
 
-			for _, fi := range a.filesInfo {
-				if cc, ok := fi.module.(*cc.Module); ok && cc.Properties.HideFromMake {
-					continue
-				}
-				fmt.Fprintln(w, "\ninclude $(CLEAR_VARS)")
-				fmt.Fprintln(w, "LOCAL_PATH :=", moduleDir)
-				fmt.Fprintln(w, "LOCAL_MODULE :=", fi.moduleName)
-				if a.flattened {
-					// /system/apex/<name>/{lib|framework|...}
-					fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", filepath.Join("$(OUT_DIR)",
-						a.installDir.RelPathString(), name, fi.installDir))
-				} else {
-					// /apex/<name>/{lib|framework|...}
-					fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", filepath.Join("$(PRODUCT_OUT)",
-						"apex", name, fi.installDir))
-				}
-				fmt.Fprintln(w, "LOCAL_PREBUILT_MODULE_FILE :=", fi.builtFile.String())
-				fmt.Fprintln(w, "LOCAL_MODULE_CLASS :=", fi.class.NameInMake())
-				fmt.Fprintln(w, "LOCAL_UNINSTALLABLE_MODULE :=", !a.installable())
-				if fi.module != nil {
-					archStr := fi.module.Target().Arch.ArchType.String()
-					host := false
-					switch fi.module.Target().Os.Class {
-					case android.Host:
-						if archStr != "common" {
-							fmt.Fprintln(w, "LOCAL_MODULE_HOST_ARCH :=", archStr)
-						}
-						host = true
-					case android.HostCross:
-						if archStr != "common" {
-							fmt.Fprintln(w, "LOCAL_MODULE_HOST_CROSS_ARCH :=", archStr)
-						}
-						host = true
-					case android.Device:
-						if archStr != "common" {
-							fmt.Fprintln(w, "LOCAL_MODULE_TARGET_ARCH :=", archStr)
-						}
-					}
-					if host {
-						makeOs := fi.module.Target().Os.String()
-						if fi.module.Target().Os == android.Linux || fi.module.Target().Os == android.LinuxBionic {
-							makeOs = "linux"
-						}
-						fmt.Fprintln(w, "LOCAL_MODULE_HOST_OS :=", makeOs)
-						fmt.Fprintln(w, "LOCAL_IS_HOST_MODULE := true")
-					}
-				}
-				if fi.class == javaSharedLib {
-					javaModule := fi.module.(*java.Library)
-					// soong_java_prebuilt.mk sets LOCAL_MODULE_SUFFIX := .jar  Therefore
-					// we need to remove the suffix from LOCAL_MODULE_STEM, otherwise
-					// we will have foo.jar.jar
-					fmt.Fprintln(w, "LOCAL_MODULE_STEM :=", strings.TrimSuffix(fi.builtFile.Base(), ".jar"))
-					fmt.Fprintln(w, "LOCAL_SOONG_CLASSES_JAR :=", javaModule.ImplementationAndResourcesJars()[0].String())
-					fmt.Fprintln(w, "LOCAL_SOONG_HEADER_JAR :=", javaModule.HeaderJars()[0].String())
-					fmt.Fprintln(w, "LOCAL_SOONG_DEX_JAR :=", fi.builtFile.String())
-					fmt.Fprintln(w, "LOCAL_DEX_PREOPT := false")
-					fmt.Fprintln(w, "include $(BUILD_SYSTEM)/soong_java_prebuilt.mk")
-				} else if fi.class == nativeSharedLib || fi.class == nativeExecutable {
-					fmt.Fprintln(w, "LOCAL_MODULE_STEM :=", fi.builtFile.Base())
-					if cc, ok := fi.module.(*cc.Module); ok && cc.UnstrippedOutputFile() != nil {
-						fmt.Fprintln(w, "LOCAL_SOONG_UNSTRIPPED_BINARY :=", cc.UnstrippedOutputFile().String())
-					}
-					fmt.Fprintln(w, "include $(BUILD_SYSTEM)/soong_cc_prebuilt.mk")
-				} else {
-					fmt.Fprintln(w, "LOCAL_MODULE_STEM :=", fi.builtFile.Base())
-					fmt.Fprintln(w, "include $(BUILD_PREBUILT)")
-				}
-			}
 			if a.flattened && apexType.image() {
 				// Only image APEXes can be flattened.
 				fmt.Fprintln(w, "\ninclude $(CLEAR_VARS)")
 				fmt.Fprintln(w, "LOCAL_PATH :=", moduleDir)
 				fmt.Fprintln(w, "LOCAL_MODULE :=", name)
-				fmt.Fprintln(w, "LOCAL_REQUIRED_MODULES :=", strings.Join(moduleNames, " "))
+				if len(moduleNames) > 0 {
+					fmt.Fprintln(w, "LOCAL_REQUIRED_MODULES :=", strings.Join(moduleNames, " "))
+				}
 				fmt.Fprintln(w, "include $(BUILD_PHONY_PACKAGE)")
 			} else {
 				// zip-apex is the less common type so have the name refer to the image-apex
@@ -1051,7 +1073,9 @@
 				fmt.Fprintln(w, "LOCAL_MODULE_STEM :=", name+apexType.suffix())
 				fmt.Fprintln(w, "LOCAL_UNINSTALLABLE_MODULE :=", !a.installable())
 				fmt.Fprintln(w, "LOCAL_REQUIRED_MODULES :=", String(a.properties.Key))
-				fmt.Fprintln(w, "LOCAL_REQUIRED_MODULES +=", strings.Join(moduleNames, " "))
+				if len(moduleNames) > 0 {
+					fmt.Fprintln(w, "LOCAL_REQUIRED_MODULES +=", strings.Join(moduleNames, " "))
+				}
 				fmt.Fprintln(w, "include $(BUILD_PREBUILT)")
 
 				if apexType == imageApex {
diff --git a/apex/apex_test.go b/apex/apex_test.go
index 9d33060..56ddd5f 100644
--- a/apex/apex_test.go
+++ b/apex/apex_test.go
@@ -47,6 +47,7 @@
 	ctx.RegisterModuleType("llndk_library", android.ModuleFactoryAdaptor(cc.LlndkLibraryFactory))
 	ctx.RegisterModuleType("toolchain_library", android.ModuleFactoryAdaptor(cc.ToolchainLibraryFactory))
 	ctx.RegisterModuleType("prebuilt_etc", android.ModuleFactoryAdaptor(android.PrebuiltEtcFactory))
+	ctx.RegisterModuleType("sh_binary", android.ModuleFactoryAdaptor(android.ShBinaryFactory))
 	ctx.PreDepsMutators(func(ctx android.RegisterMutatorsContext) {
 		ctx.BottomUp("image", cc.ImageMutator).Parallel()
 		ctx.BottomUp("link", cc.LinkageMutator).Parallel()
@@ -615,7 +616,10 @@
 		apex {
 			name: "myapex",
 			key: "myapex.key",
+			native_shared_libs: ["mylib"],
+			binaries: ["mybin"],
 			prebuilts: ["myetc"],
+			compile_multilib: "both",
 		}
 
 		apex_key {
@@ -629,15 +633,43 @@
 			src: "myprebuilt",
 			sub_dir: "foo/bar",
 		}
+
+		cc_library {
+			name: "mylib",
+			srcs: ["mylib.cpp"],
+			relative_install_path: "foo/bar",
+			system_shared_libs: [],
+			stl: "none",
+		}
+
+		cc_binary {
+			name: "mybin",
+			srcs: ["mylib.cpp"],
+			relative_install_path: "foo/bar",
+			system_shared_libs: [],
+			static_executable: true,
+			stl: "none",
+		}
 	`)
 
 	generateFsRule := ctx.ModuleForTests("myapex", "android_common_myapex").Rule("generateFsConfig")
 	dirs := strings.Split(generateFsRule.Args["exec_paths"], " ")
 
-	// Ensure that etc, etc/foo, and etc/foo/bar are all listed
+	// Ensure that the subdirectories are all listed
 	ensureListContains(t, dirs, "etc")
 	ensureListContains(t, dirs, "etc/foo")
 	ensureListContains(t, dirs, "etc/foo/bar")
+	ensureListContains(t, dirs, "lib64")
+	ensureListContains(t, dirs, "lib64/foo")
+	ensureListContains(t, dirs, "lib64/foo/bar")
+	ensureListContains(t, dirs, "lib")
+	ensureListContains(t, dirs, "lib/foo")
+	ensureListContains(t, dirs, "lib/foo/bar")
+
+	// TODO(b/123721777) respect relative path for binaries
+	// ensureListContains(t, dirs, "bin")
+	// ensureListContains(t, dirs, "bin/foo")
+	// ensureListContains(t, dirs, "bin/foo/bar")
 }
 
 func TestUseVendor(t *testing.T) {
@@ -944,3 +976,31 @@
 	ensureListContains(t, ctx.ModuleVariantsForTests("mylib_common"), "android_arm64_armv8-a_core_shared")
 	ensureListContains(t, ctx.ModuleVariantsForTests("mylib2"), "android_arm64_armv8-a_core_shared")
 }
+
+func TestApexWithShBinary(t *testing.T) {
+	ctx := testApex(t, `
+		apex {
+			name: "myapex",
+			key: "myapex.key",
+			binaries: ["myscript"],
+		}
+
+		apex_key {
+			name: "myapex.key",
+			public_key: "testkey.avbpubkey",
+			private_key: "testkey.pem",
+		}
+
+		sh_binary {
+			name: "myscript",
+			src: "mylib.cpp",
+			filename: "myscript.sh",
+			sub_dir: "script",
+		}
+	`)
+
+	apexRule := ctx.ModuleForTests("myapex", "android_common_myapex").Rule("apexRule")
+	copyCmds := apexRule.Args["copy_commands"]
+
+	ensureContains(t, copyCmds, "image.apex/bin/script/myscript.sh")
+}
diff --git a/apex/key.go b/apex/key.go
index 6d1032d..5282416 100644
--- a/apex/key.go
+++ b/apex/key.go
@@ -63,11 +63,6 @@
 }
 
 func (m *apexKey) GenerateAndroidBuildActions(ctx android.ModuleContext) {
-	if ctx.Config().FlattenApex() && !ctx.Config().UnbundledBuild() {
-		// Flattened APEXes are not signed
-		return
-	}
-
 	m.public_key_file = ctx.Config().ApexKeyDir(ctx).Join(ctx, String(m.properties.Public_key))
 	m.private_key_file = ctx.Config().ApexKeyDir(ctx).Join(ctx, String(m.properties.Private_key))
 
diff --git a/cc/androidmk.go b/cc/androidmk.go
index 0e4245e..fc791fe 100644
--- a/cc/androidmk.go
+++ b/cc/androidmk.go
@@ -152,7 +152,9 @@
 		ret.Class = "SHARED_LIBRARIES"
 		ret.Extra = append(ret.Extra, func(w io.Writer, outputFile android.Path) {
 			fmt.Fprintln(w, "LOCAL_SOONG_TOC :=", library.toc().String())
-			fmt.Fprintln(w, "LOCAL_SOONG_UNSTRIPPED_BINARY :=", library.unstrippedOutputFile.String())
+			if !library.buildStubs() {
+				fmt.Fprintln(w, "LOCAL_SOONG_UNSTRIPPED_BINARY :=", library.unstrippedOutputFile.String())
+			}
 			if len(library.Properties.Overrides) > 0 {
 				fmt.Fprintln(w, "LOCAL_OVERRIDES_MODULES := "+strings.Join(library.Properties.Overrides, " "))
 			}
diff --git a/cc/binary.go b/cc/binary.go
index a8eb641..4794815 100644
--- a/cc/binary.go
+++ b/cc/binary.go
@@ -317,9 +317,9 @@
 	builderFlags := flagsToBuilderFlags(flags)
 
 	if binary.stripper.needsStrip(ctx) {
-		// b/80093681, GNU strip/objcopy bug.
-		// Use llvm-{strip,objcopy} when clang lld is used.
-		builderFlags.stripUseLlvmStrip = binary.baseLinker.useClangLld(ctx)
+		if ctx.Darwin() {
+			builderFlags.stripUseGnuStrip = true
+		}
 		strippedOutputFile := outputFile
 		outputFile = android.PathForModuleOut(ctx, "unstripped", fileName)
 		binary.stripper.strip(ctx, outputFile, strippedOutputFile, builderFlags)
diff --git a/cc/builder.go b/cc/builder.go
index 645b3c2..6e24d56 100644
--- a/cc/builder.go
+++ b/cc/builder.go
@@ -255,7 +255,7 @@
 	stripKeepSymbols       bool
 	stripKeepMiniDebugInfo bool
 	stripAddGnuDebuglink   bool
-	stripUseLlvmStrip      bool
+	stripUseGnuStrip       bool
 
 	protoDeps        android.Paths
 	protoFlags       string
@@ -821,8 +821,8 @@
 	if flags.stripKeepSymbols {
 		args += " --keep-symbols"
 	}
-	if flags.stripUseLlvmStrip {
-		args += " --use-llvm-strip"
+	if flags.stripUseGnuStrip {
+		args += " --use-gnu-strip"
 	}
 
 	ctx.Build(pctx, android.BuildParams{
diff --git a/cc/cc.go b/cc/cc.go
index 5a2f0ae..02f36d5 100644
--- a/cc/cc.go
+++ b/cc/cc.go
@@ -315,6 +315,7 @@
 	inData() bool
 	inSanitizerDir() bool
 	hostToolPath() android.OptionalPath
+	relativeInstallPath() string
 }
 
 type dependencyTag struct {
@@ -413,6 +414,13 @@
 	return nil
 }
 
+func (c *Module) RelativeInstallPath() string {
+	if c.installer != nil {
+		return c.installer.relativeInstallPath()
+	}
+	return ""
+}
+
 func (c *Module) Init() android.Module {
 	c.AddProperties(&c.Properties, &c.VendorProperties)
 	if c.compiler != nil {
diff --git a/cc/compiler.go b/cc/compiler.go
index fbe10b5..0aee0bd 100644
--- a/cc/compiler.go
+++ b/cc/compiler.go
@@ -250,8 +250,8 @@
 	return false
 }
 
-func addToModuleList(ctx ModuleContext, list string, module string) {
-	getNamedMapForConfig(ctx.Config(), list).Store(module, true)
+func addToModuleList(ctx ModuleContext, key android.OnceKey, module string) {
+	getNamedMapForConfig(ctx.Config(), key).Store(module, true)
 }
 
 // Create a Flags struct that collects the compile flags from global values,
@@ -503,10 +503,10 @@
 	if len(compiler.Properties.Srcs) > 0 {
 		module := ctx.ModuleDir() + "/Android.bp:" + ctx.ModuleName()
 		if inList("-Wno-error", flags.CFlags) || inList("-Wno-error", flags.CppFlags) {
-			addToModuleList(ctx, modulesUsingWnoError, module)
+			addToModuleList(ctx, modulesUsingWnoErrorKey, module)
 		} else if !inList("-Werror", flags.CFlags) && !inList("-Werror", flags.CppFlags) {
 			if warningsAreAllowed(ctx.ModuleDir()) {
-				addToModuleList(ctx, modulesAddedWall, module)
+				addToModuleList(ctx, modulesAddedWallKey, module)
 				flags.CFlags = append([]string{"-Wall"}, flags.CFlags...)
 			} else {
 				flags.CFlags = append([]string{"-Wall", "-Werror"}, flags.CFlags...)
diff --git a/cc/installer.go b/cc/installer.go
index 33f29f2..bd8f9e7 100644
--- a/cc/installer.go
+++ b/cc/installer.go
@@ -73,7 +73,7 @@
 		dir = filepath.Join(dir, "vendor")
 	}
 	return android.PathForModuleInstall(ctx, dir, installer.subDir,
-		String(installer.Properties.Relative_install_path), installer.relative)
+		installer.relativeInstallPath(), installer.relative)
 }
 
 func (installer *baseInstaller) install(ctx ModuleContext, file android.Path) {
@@ -91,3 +91,7 @@
 func (installer *baseInstaller) hostToolPath() android.OptionalPath {
 	return android.OptionalPath{}
 }
+
+func (installer *baseInstaller) relativeInstallPath() string {
+	return String(installer.Properties.Relative_install_path)
+}
diff --git a/cc/library.go b/cc/library.go
index 13acfae..b4b89d2 100644
--- a/cc/library.go
+++ b/cc/library.go
@@ -686,9 +686,9 @@
 	TransformSharedObjectToToc(ctx, outputFile, tocFile, builderFlags)
 
 	if library.stripper.needsStrip(ctx) {
-		// b/80093681, GNU strip/objcopy bug.
-		// Use llvm-{strip,objcopy} when clang lld is used.
-		builderFlags.stripUseLlvmStrip = library.baseLinker.useClangLld(ctx)
+		if ctx.Darwin() {
+			builderFlags.stripUseGnuStrip = true
+		}
 		strippedOutputFile := outputFile
 		outputFile = android.PathForModuleOut(ctx, "unstripped", fileName)
 		library.stripper.strip(ctx, outputFile, strippedOutputFile, builderFlags)
@@ -968,8 +968,10 @@
 	return library.MutatedProperties.StubsVersion
 }
 
+var versioningMacroNamesListKey = android.NewOnceKey("versioningMacroNamesList")
+
 func versioningMacroNamesList(config android.Config) *map[string]string {
-	return config.Once("versioningMacroNamesList", func() interface{} {
+	return config.Once(versioningMacroNamesListKey, func() interface{} {
 		m := make(map[string]string)
 		return &m
 	}).(*map[string]string)
@@ -1059,9 +1061,11 @@
 	}
 }
 
+var stubVersionsKey = android.NewOnceKey("stubVersions")
+
 // maps a module name to the list of stubs versions available for the module
 func stubsVersionsFor(config android.Config) map[string][]string {
-	return config.Once("stubVersions", func() interface{} {
+	return config.Once(stubVersionsKey, func() interface{} {
 		return make(map[string][]string)
 	}).(map[string][]string)
 }
diff --git a/cc/makevars.go b/cc/makevars.go
index 32674a9..d91735f 100644
--- a/cc/makevars.go
+++ b/cc/makevars.go
@@ -24,24 +24,24 @@
 	"android/soong/cc/config"
 )
 
-const (
-	modulesAddedWall          = "ModulesAddedWall"
-	modulesUsingWnoError      = "ModulesUsingWnoError"
-	modulesMissingProfileFile = "ModulesMissingProfileFile"
+var (
+	modulesAddedWallKey          = android.NewOnceKey("ModulesAddedWall")
+	modulesUsingWnoErrorKey      = android.NewOnceKey("ModulesUsingWnoError")
+	modulesMissingProfileFileKey = android.NewOnceKey("ModulesMissingProfileFile")
 )
 
 func init() {
 	android.RegisterMakeVarsProvider(pctx, makeVarsProvider)
 }
 
-func getNamedMapForConfig(config android.Config, name string) *sync.Map {
-	return config.Once(name, func() interface{} {
+func getNamedMapForConfig(config android.Config, key android.OnceKey) *sync.Map {
+	return config.Once(key, func() interface{} {
 		return &sync.Map{}
 	}).(*sync.Map)
 }
 
-func makeStringOfKeys(ctx android.MakeVarsContext, setName string) string {
-	set := getNamedMapForConfig(ctx.Config(), setName)
+func makeStringOfKeys(ctx android.MakeVarsContext, key android.OnceKey) string {
+	set := getNamedMapForConfig(ctx.Config(), key)
 	keys := []string{}
 	set.Range(func(key interface{}, value interface{}) bool {
 		keys = append(keys, key.(string))
@@ -117,9 +117,9 @@
 	ctx.Strict("LSDUMP_PATHS", strings.Join(lsdumpPaths, " "))
 
 	ctx.Strict("ANDROID_WARNING_ALLOWED_PROJECTS", makeStringOfWarningAllowedProjects())
-	ctx.Strict("SOONG_MODULES_ADDED_WALL", makeStringOfKeys(ctx, modulesAddedWall))
-	ctx.Strict("SOONG_MODULES_USING_WNO_ERROR", makeStringOfKeys(ctx, modulesUsingWnoError))
-	ctx.Strict("SOONG_MODULES_MISSING_PGO_PROFILE_FILE", makeStringOfKeys(ctx, modulesMissingProfileFile))
+	ctx.Strict("SOONG_MODULES_ADDED_WALL", makeStringOfKeys(ctx, modulesAddedWallKey))
+	ctx.Strict("SOONG_MODULES_USING_WNO_ERROR", makeStringOfKeys(ctx, modulesUsingWnoErrorKey))
+	ctx.Strict("SOONG_MODULES_MISSING_PGO_PROFILE_FILE", makeStringOfKeys(ctx, modulesMissingProfileFileKey))
 
 	ctx.Strict("ADDRESS_SANITIZER_CONFIG_EXTRA_CFLAGS", strings.Join(asanCflags, " "))
 	ctx.Strict("ADDRESS_SANITIZER_CONFIG_EXTRA_LDFLAGS", strings.Join(asanLdflags, " "))
@@ -178,14 +178,6 @@
 		makeVarsToolchain(ctx, "2ND_", hostTargets[1])
 	}
 
-	crossTargets := ctx.Config().Targets[android.Windows]
-	if len(crossTargets) > 0 {
-		makeVarsToolchain(ctx, "", crossTargets[0])
-		if len(crossTargets) > 1 {
-			makeVarsToolchain(ctx, "2ND_", crossTargets[1])
-		}
-	}
-
 	deviceTargets := ctx.Config().Targets[android.Android]
 	makeVarsToolchain(ctx, "", deviceTargets[0])
 	if len(deviceTargets) > 1 {
@@ -199,8 +191,6 @@
 	switch target.Os.Class {
 	case android.Host:
 		typePrefix = "HOST_"
-	case android.HostCross:
-		typePrefix = "HOST_CROSS_"
 	case android.Device:
 		typePrefix = "TARGET_"
 	}
@@ -301,10 +291,6 @@
 		ctx.Strict(makePrefix+"STRIP", gccCmd(toolchain, "strip"))
 	}
 
-	if target.Os == android.Windows {
-		ctx.Strict(makePrefix+"OBJDUMP", gccCmd(toolchain, "objdump"))
-	}
-
 	if target.Os.Class == android.Device {
 		ctx.Strict(makePrefix+"OBJCOPY", gccCmd(toolchain, "objcopy"))
 		ctx.Strict(makePrefix+"LD", gccCmd(toolchain, "ld"))
@@ -313,7 +299,7 @@
 		ctx.Strict(makePrefix+"TOOLS_PREFIX", gccCmd(toolchain, ""))
 	}
 
-	if target.Os.Class == android.Host || target.Os.Class == android.HostCross {
+	if target.Os.Class == android.Host {
 		ctx.Strict(makePrefix+"AVAILABLE_LIBRARIES", strings.Join(toolchain.AvailableLibraries(), " "))
 	}
 
diff --git a/cc/pgo.go b/cc/pgo.go
index a341ab9..9363916 100644
--- a/cc/pgo.go
+++ b/cc/pgo.go
@@ -36,7 +36,8 @@
 	}
 )
 
-const pgoProfileProjectsConfigKey = "PgoProfileProjects"
+var pgoProfileProjectsConfigKey = android.NewOnceKey("PgoProfileProjects")
+
 const profileInstrumentFlag = "-fprofile-generate=/data/local/tmp"
 const profileSamplingFlag = "-gline-tables-only"
 const profileUseInstrumentFormat = "-fprofile-use=%s"
@@ -49,7 +50,7 @@
 }
 
 func recordMissingProfileFile(ctx BaseModuleContext, missing string) {
-	getNamedMapForConfig(ctx.Config(), modulesMissingProfileFile).Store(missing, true)
+	getNamedMapForConfig(ctx.Config(), modulesMissingProfileFileKey).Store(missing, true)
 }
 
 type PgoProperties struct {
diff --git a/cc/sanitize.go b/cc/sanitize.go
index c13b855..fc2ed50 100644
--- a/cc/sanitize.go
+++ b/cc/sanitize.go
@@ -370,8 +370,8 @@
 		sanitize.Properties.SanitizerEnabled = true
 	}
 
-	// Disable Scudo if ASan or TSan is enabled.
-	if Bool(s.Address) || Bool(s.Thread) || Bool(s.Hwaddress) {
+	// Disable Scudo if ASan or TSan is enabled, or if it's disabled globally.
+	if Bool(s.Address) || Bool(s.Thread) || Bool(s.Hwaddress) || ctx.Config().DisableScudo() {
 		s.Scudo = nil
 	}
 
@@ -958,20 +958,26 @@
 	}
 }
 
+var cfiStaticLibsKey = android.NewOnceKey("cfiStaticLibs")
+
 func cfiStaticLibs(config android.Config) *[]string {
-	return config.Once("cfiStaticLibs", func() interface{} {
+	return config.Once(cfiStaticLibsKey, func() interface{} {
 		return &[]string{}
 	}).(*[]string)
 }
 
+var hwasanStaticLibsKey = android.NewOnceKey("hwasanStaticLibs")
+
 func hwasanStaticLibs(config android.Config) *[]string {
-	return config.Once("hwasanStaticLibs", func() interface{} {
+	return config.Once(hwasanStaticLibsKey, func() interface{} {
 		return &[]string{}
 	}).(*[]string)
 }
 
+var hwasanVendorStaticLibsKey = android.NewOnceKey("hwasanVendorStaticLibs")
+
 func hwasanVendorStaticLibs(config android.Config) *[]string {
-	return config.Once("hwasanVendorStaticLibs", func() interface{} {
+	return config.Once(hwasanVendorStaticLibsKey, func() interface{} {
 		return &[]string{}
 	}).(*[]string)
 }
diff --git a/dexpreopt/Android.bp b/dexpreopt/Android.bp
index b832529..c5f24e2 100644
--- a/dexpreopt/Android.bp
+++ b/dexpreopt/Android.bp
@@ -4,12 +4,12 @@
     srcs: [
         "config.go",
         "dexpreopt.go",
-        "script.go",
     ],
     testSrcs: [
         "dexpreopt_test.go",
     ],
     deps: [
         "blueprint-pathtools",
+        "soong-android",
     ],
-}
\ No newline at end of file
+}
diff --git a/dexpreopt/dexpreopt.go b/dexpreopt/dexpreopt.go
index f316be4..c38fbff 100644
--- a/dexpreopt/dexpreopt.go
+++ b/dexpreopt/dexpreopt.go
@@ -39,6 +39,8 @@
 	"path/filepath"
 	"strings"
 
+	"android/soong/android"
+
 	"github.com/google/blueprint/pathtools"
 )
 
@@ -47,7 +49,7 @@
 
 // GenerateStripRule generates a set of commands that will take an APK or JAR as an input and strip the dex files if
 // they are no longer necessary after preopting.
-func GenerateStripRule(global GlobalConfig, module ModuleConfig) (rule *Rule, err error) {
+func GenerateStripRule(global GlobalConfig, module ModuleConfig) (rule *android.RuleBuilder, err error) {
 	defer func() {
 		if r := recover(); r != nil {
 			if e, ok := r.(error); ok {
@@ -61,7 +63,7 @@
 
 	tools := global.Tools
 
-	rule = &Rule{}
+	rule = android.NewRuleBuilder()
 
 	strip := shouldStripDex(module, global)
 
@@ -81,7 +83,7 @@
 
 // GenerateDexpreoptRule generates a set of commands that will preopt a module based on a GlobalConfig and a
 // ModuleConfig.  The produced files and their install locations will be available through rule.Installs().
-func GenerateDexpreoptRule(global GlobalConfig, module ModuleConfig) (rule *Rule, err error) {
+func GenerateDexpreoptRule(global GlobalConfig, module ModuleConfig) (rule *android.RuleBuilder, err error) {
 	defer func() {
 		if r := recover(); r != nil {
 			if e, ok := r.(error); ok {
@@ -93,7 +95,7 @@
 		}
 	}()
 
-	rule = &Rule{}
+	rule = android.NewRuleBuilder()
 
 	generateProfile := module.ProfileClassListing != "" && !global.DisableGenerateProfile
 
@@ -141,7 +143,7 @@
 	return false
 }
 
-func profileCommand(global GlobalConfig, module ModuleConfig, rule *Rule) string {
+func profileCommand(global GlobalConfig, module ModuleConfig, rule *android.RuleBuilder) string {
 	profilePath := filepath.Join(filepath.Dir(module.BuildPath), "profile.prof")
 	profileInstalledPath := module.DexLocation + ".prof"
 
@@ -178,8 +180,8 @@
 	return profilePath
 }
 
-func dexpreoptCommand(global GlobalConfig, module ModuleConfig, rule *Rule, profile, arch, bootImageLocation string,
-	appImage, generateDM bool) {
+func dexpreoptCommand(global GlobalConfig, module ModuleConfig, rule *android.RuleBuilder,
+	profile, arch, bootImageLocation string, appImage, generateDM bool) {
 
 	// HACK: make soname in Soong-generated .odex files match Make.
 	base := filepath.Base(module.DexLocation)
diff --git a/dexpreopt/dexpreopt_gen/dexpreopt_gen.go b/dexpreopt/dexpreopt_gen/dexpreopt_gen.go
index 46d8795..1467a02 100644
--- a/dexpreopt/dexpreopt_gen/dexpreopt_gen.go
+++ b/dexpreopt/dexpreopt_gen/dexpreopt_gen.go
@@ -22,6 +22,7 @@
 	"path/filepath"
 	"runtime"
 
+	"android/soong/android"
 	"android/soong/dexpreopt"
 
 	"github.com/google/blueprint/pathtools"
@@ -121,7 +122,7 @@
 		panic(err)
 	}
 
-	write := func(rule *dexpreopt.Rule, file string) {
+	write := func(rule *android.RuleBuilder, file string) {
 		script := &bytes.Buffer{}
 		script.WriteString(scriptHeader)
 		for _, c := range rule.Commands() {
diff --git a/dexpreopt/dexpreopt_test.go b/dexpreopt/dexpreopt_test.go
index 073d463..6e520f1 100644
--- a/dexpreopt/dexpreopt_test.go
+++ b/dexpreopt/dexpreopt_test.go
@@ -15,6 +15,7 @@
 package dexpreopt
 
 import (
+	"android/soong/android"
 	"reflect"
 	"strings"
 	"testing"
@@ -100,7 +101,7 @@
 		t.Error(err)
 	}
 
-	wantInstalls := []Install{
+	wantInstalls := []android.RuleBuilderInstall{
 		{"out/test/oat/arm/package.odex", "/system/app/test/oat/arm/test.odex"},
 		{"out/test/oat/arm/package.vdex", "/system/app/test/oat/arm/test.vdex"},
 	}
@@ -126,7 +127,7 @@
 		t.Error(err)
 	}
 
-	wantInstalls := []Install{
+	wantInstalls := []android.RuleBuilderInstall{
 		{"out/test/oat/arm/package.odex", "/system_other/app/test/oat/arm/test.odex"},
 		{"out/test/oat/arm/package.vdex", "/system_other/app/test/oat/arm/test.vdex"},
 	}
@@ -150,7 +151,7 @@
 		t.Error(err)
 	}
 
-	wantInstalls := []Install{
+	wantInstalls := []android.RuleBuilderInstall{
 		{"out/test/profile.prof", "/system/app/test/test.apk.prof"},
 		{"out/test/oat/arm/package.art", "/system/app/test/oat/arm/test.art"},
 		{"out/test/oat/arm/package.odex", "/system/app/test/oat/arm/test.odex"},
diff --git a/dexpreopt/script.go b/dexpreopt/script.go
deleted file mode 100644
index 9d4329c..0000000
--- a/dexpreopt/script.go
+++ /dev/null
@@ -1,178 +0,0 @@
-// Copyright 2018 Google Inc. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package dexpreopt
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-)
-
-type Install struct {
-	From, To string
-}
-
-type Rule struct {
-	commands []*Command
-	installs []Install
-}
-
-func (r *Rule) Install(from, to string) {
-	r.installs = append(r.installs, Install{from, to})
-}
-
-func (r *Rule) Command() *Command {
-	command := &Command{}
-	r.commands = append(r.commands, command)
-	return command
-}
-
-func (r *Rule) Inputs() []string {
-	outputs := r.outputSet()
-
-	inputs := make(map[string]bool)
-	for _, c := range r.commands {
-		for _, input := range c.inputs {
-			if !outputs[input] {
-				inputs[input] = true
-			}
-		}
-	}
-
-	var inputList []string
-	for input := range inputs {
-		inputList = append(inputList, input)
-	}
-	sort.Strings(inputList)
-
-	return inputList
-}
-
-func (r *Rule) outputSet() map[string]bool {
-	outputs := make(map[string]bool)
-	for _, c := range r.commands {
-		for _, output := range c.outputs {
-			outputs[output] = true
-		}
-	}
-	return outputs
-}
-
-func (r *Rule) Outputs() []string {
-	outputs := r.outputSet()
-
-	var outputList []string
-	for output := range outputs {
-		outputList = append(outputList, output)
-	}
-	sort.Strings(outputList)
-	return outputList
-}
-
-func (r *Rule) Installs() []Install {
-	return append([]Install(nil), r.installs...)
-}
-
-func (r *Rule) Tools() []string {
-	var tools []string
-	for _, c := range r.commands {
-		tools = append(tools, c.tools...)
-	}
-	return tools
-}
-
-func (r *Rule) Commands() []string {
-	var commands []string
-	for _, c := range r.commands {
-		commands = append(commands, string(c.buf))
-	}
-	return commands
-}
-
-type Command struct {
-	buf     []byte
-	inputs  []string
-	outputs []string
-	tools   []string
-}
-
-func (c *Command) Text(text string) *Command {
-	if len(c.buf) > 0 {
-		c.buf = append(c.buf, ' ')
-	}
-	c.buf = append(c.buf, text...)
-	return c
-}
-
-func (c *Command) Textf(format string, a ...interface{}) *Command {
-	return c.Text(fmt.Sprintf(format, a...))
-}
-
-func (c *Command) Flag(flag string) *Command {
-	return c.Text(flag)
-}
-
-func (c *Command) FlagWithArg(flag, arg string) *Command {
-	return c.Text(flag + arg)
-}
-
-func (c *Command) FlagWithList(flag string, list []string, sep string) *Command {
-	return c.Text(flag + strings.Join(list, sep))
-}
-
-func (c *Command) Tool(path string) *Command {
-	c.tools = append(c.tools, path)
-	return c.Text(path)
-}
-
-func (c *Command) Input(path string) *Command {
-	c.inputs = append(c.inputs, path)
-	return c.Text(path)
-}
-
-func (c *Command) Implicit(path string) *Command {
-	c.inputs = append(c.inputs, path)
-	return c
-}
-
-func (c *Command) Implicits(paths []string) *Command {
-	c.inputs = append(c.inputs, paths...)
-	return c
-}
-
-func (c *Command) Output(path string) *Command {
-	c.outputs = append(c.outputs, path)
-	return c.Text(path)
-}
-
-func (c *Command) ImplicitOutput(path string) *Command {
-	c.outputs = append(c.outputs, path)
-	return c
-}
-
-func (c *Command) FlagWithInput(flag, path string) *Command {
-	c.inputs = append(c.inputs, path)
-	return c.Text(flag + path)
-}
-
-func (c *Command) FlagWithInputList(flag string, paths []string, sep string) *Command {
-	c.inputs = append(c.inputs, paths...)
-	return c.FlagWithList(flag, paths, sep)
-}
-
-func (c *Command) FlagWithOutput(flag, path string) *Command {
-	c.outputs = append(c.outputs, path)
-	return c.Text(flag + path)
-}
diff --git a/java/aar.go b/java/aar.go
index d08e487..b96f127 100644
--- a/java/aar.go
+++ b/java/aar.go
@@ -26,6 +26,7 @@
 	Dependency
 	ExportPackage() android.Path
 	ExportedProguardFlagFiles() android.Paths
+	ExportedRRODirs() android.Paths
 	ExportedStaticPackages() android.Paths
 	ExportedManifest() android.Path
 }
@@ -80,6 +81,14 @@
 	return a.exportPackage
 }
 
+func (a *aapt) ExportedRRODirs() android.Paths {
+	return a.rroDirs
+}
+
+func (a *aapt) ExportedManifest() android.Path {
+	return a.manifestPath
+}
+
 func (a *aapt) aapt2Flags(ctx android.ModuleContext, sdkContext sdkContext, manifestPath android.Path) (flags []string,
 	deps android.Paths, resDirs, overlayDirs []globbedResourceDir, rroDirs android.Paths) {
 
@@ -164,7 +173,7 @@
 }
 
 func (a *aapt) buildActions(ctx android.ModuleContext, sdkContext sdkContext, extraLinkFlags ...string) {
-	transitiveStaticLibs, staticLibManifests, libDeps, libFlags := aaptLibs(ctx, sdkContext)
+	transitiveStaticLibs, staticLibManifests, staticRRODirs, libDeps, libFlags := aaptLibs(ctx, sdkContext)
 
 	// App manifest file
 	manifestFile := proptools.StringDefault(a.aaptProperties.Manifest, "AndroidManifest.xml")
@@ -174,6 +183,8 @@
 
 	linkFlags, linkDeps, resDirs, overlayDirs, rroDirs := a.aapt2Flags(ctx, sdkContext, manifestPath)
 
+	rroDirs = append(rroDirs, staticRRODirs...)
+
 	linkFlags = append(linkFlags, libFlags...)
 	linkDeps = append(linkDeps, libDeps...)
 	linkFlags = append(linkFlags, extraLinkFlags...)
@@ -235,7 +246,7 @@
 
 // aaptLibs collects libraries from dependencies and sdk_version and converts them into paths
 func aaptLibs(ctx android.ModuleContext, sdkContext sdkContext) (transitiveStaticLibs, staticLibManifests,
-	deps android.Paths, flags []string) {
+	staticRRODirs, deps android.Paths, flags []string) {
 
 	var sharedLibs android.Paths
 
@@ -263,6 +274,7 @@
 				transitiveStaticLibs = append(transitiveStaticLibs, exportPackage)
 				transitiveStaticLibs = append(transitiveStaticLibs, aarDep.ExportedStaticPackages()...)
 				staticLibManifests = append(staticLibManifests, aarDep.ExportedManifest())
+				staticRRODirs = append(staticRRODirs, aarDep.ExportedRRODirs()...)
 			}
 		}
 	})
@@ -279,8 +291,9 @@
 	}
 
 	transitiveStaticLibs = android.FirstUniquePaths(transitiveStaticLibs)
+	staticRRODirs = android.FirstUniquePaths(staticRRODirs)
 
-	return transitiveStaticLibs, staticLibManifests, deps, flags
+	return transitiveStaticLibs, staticLibManifests, staticRRODirs, deps, flags
 }
 
 type AndroidLibrary struct {
@@ -303,10 +316,6 @@
 	return a.exportedStaticPackages
 }
 
-func (a *AndroidLibrary) ExportedManifest() android.Path {
-	return a.manifestPath
-}
-
 var _ AndroidLibraryDependency = (*AndroidLibrary)(nil)
 
 func (a *AndroidLibrary) DepsMutator(ctx android.BottomUpMutatorContext) {
@@ -426,6 +435,10 @@
 	return android.Paths{a.proguardFlags}
 }
 
+func (a *AARImport) ExportedRRODirs() android.Paths {
+	return nil
+}
+
 func (a *AARImport) ExportedStaticPackages() android.Paths {
 	return a.exportedStaticPackages
 }
@@ -518,9 +531,10 @@
 	linkFlags = append(linkFlags, "--manifest "+a.manifest.String())
 	linkDeps = append(linkDeps, a.manifest)
 
-	transitiveStaticLibs, staticLibManifests, libDeps, libFlags := aaptLibs(ctx, sdkContext(a))
+	transitiveStaticLibs, staticLibManifests, staticRRODirs, libDeps, libFlags := aaptLibs(ctx, sdkContext(a))
 
 	_ = staticLibManifests
+	_ = staticRRODirs
 
 	linkDeps = append(linkDeps, libDeps...)
 	linkFlags = append(linkFlags, libFlags...)
diff --git a/java/android_resources.go b/java/android_resources.go
index efd3e3d..44cb709 100644
--- a/java/android_resources.go
+++ b/java/android_resources.go
@@ -46,7 +46,7 @@
 	paths android.DirectorySortedPaths
 }
 
-const overlayDataKey = "overlayDataKey"
+var overlayDataKey = android.NewOnceKey("overlayDataKey")
 
 type globbedResourceDir struct {
 	dir   android.Path
diff --git a/java/app.go b/java/app.go
index e9c12e0..08714f2 100644
--- a/java/app.go
+++ b/java/app.go
@@ -95,10 +95,6 @@
 	return nil
 }
 
-func (a *AndroidApp) ExportedManifest() android.Path {
-	return a.manifestPath
-}
-
 var _ AndroidLibraryDependency = (*AndroidApp)(nil)
 
 type Certificate struct {
diff --git a/java/app_test.go b/java/app_test.go
index 2455145..93d20d0 100644
--- a/java/app_test.go
+++ b/java/app_test.go
@@ -106,68 +106,86 @@
 	}
 }
 
-var testEnforceRROTests = []struct {
-	name                       string
-	enforceRROTargets          []string
-	enforceRROExcludedOverlays []string
-	overlayFiles               map[string][]string
-	rroDirs                    map[string][]string
-}{
-	{
-		name:                       "no RRO",
-		enforceRROTargets:          nil,
-		enforceRROExcludedOverlays: nil,
-		overlayFiles: map[string][]string{
-			"foo": []string{
-				"device/vendor/blah/static_overlay/foo/res/values/strings.xml",
-				"device/vendor/blah/overlay/foo/res/values/strings.xml",
-			},
-			"bar": []string{
-				"device/vendor/blah/static_overlay/bar/res/values/strings.xml",
-				"device/vendor/blah/overlay/bar/res/values/strings.xml",
-			},
-		},
-		rroDirs: map[string][]string{
-			"foo": nil,
-			"bar": nil,
-		},
-	},
-	{
-		name:                       "enforce RRO on foo",
-		enforceRROTargets:          []string{"foo"},
-		enforceRROExcludedOverlays: []string{"device/vendor/blah/static_overlay"},
-		overlayFiles: map[string][]string{
-			"foo": []string{"device/vendor/blah/static_overlay/foo/res/values/strings.xml"},
-			"bar": []string{
-				"device/vendor/blah/static_overlay/bar/res/values/strings.xml",
-				"device/vendor/blah/overlay/bar/res/values/strings.xml",
-			},
-		},
-		rroDirs: map[string][]string{
-			"foo": []string{"device/vendor/blah/overlay/foo/res"},
-			"bar": nil,
-		},
-	},
-	{
-		name:              "enforce RRO on all",
-		enforceRROTargets: []string{"*"},
-		enforceRROExcludedOverlays: []string{
-			// Excluding specific apps/res directories also allowed.
-			"device/vendor/blah/static_overlay/foo",
-			"device/vendor/blah/static_overlay/bar/res",
-		},
-		overlayFiles: map[string][]string{
-			"foo": []string{"device/vendor/blah/static_overlay/foo/res/values/strings.xml"},
-			"bar": []string{"device/vendor/blah/static_overlay/bar/res/values/strings.xml"},
-		},
-		rroDirs: map[string][]string{
-			"foo": []string{"device/vendor/blah/overlay/foo/res"},
-			"bar": []string{"device/vendor/blah/overlay/bar/res"},
-		},
-	},
-}
-
 func TestEnforceRRO(t *testing.T) {
+	testCases := []struct {
+		name                       string
+		enforceRROTargets          []string
+		enforceRROExcludedOverlays []string
+		overlayFiles               map[string][]string
+		rroDirs                    map[string][]string
+	}{
+		{
+			name:                       "no RRO",
+			enforceRROTargets:          nil,
+			enforceRROExcludedOverlays: nil,
+			overlayFiles: map[string][]string{
+				"foo": []string{
+					buildDir + "/.intermediates/lib/android_common/package-res.apk",
+					"foo/res/res/values/strings.xml",
+					"device/vendor/blah/static_overlay/foo/res/values/strings.xml",
+					"device/vendor/blah/overlay/foo/res/values/strings.xml",
+				},
+				"bar": []string{
+					"device/vendor/blah/static_overlay/bar/res/values/strings.xml",
+					"device/vendor/blah/overlay/bar/res/values/strings.xml",
+				},
+			},
+			rroDirs: map[string][]string{
+				"foo": nil,
+				"bar": nil,
+			},
+		},
+		{
+			name:                       "enforce RRO on foo",
+			enforceRROTargets:          []string{"foo"},
+			enforceRROExcludedOverlays: []string{"device/vendor/blah/static_overlay"},
+			overlayFiles: map[string][]string{
+				"foo": []string{
+					buildDir + "/.intermediates/lib/android_common/package-res.apk",
+					"foo/res/res/values/strings.xml",
+					"device/vendor/blah/static_overlay/foo/res/values/strings.xml",
+				},
+				"bar": []string{
+					"device/vendor/blah/static_overlay/bar/res/values/strings.xml",
+					"device/vendor/blah/overlay/bar/res/values/strings.xml",
+				},
+			},
+
+			rroDirs: map[string][]string{
+				"foo": []string{
+					"device/vendor/blah/overlay/foo/res",
+					// Enforce RRO on "foo" could imply RRO on static dependencies, but for now it doesn't.
+					// "device/vendor/blah/overlay/lib/res",
+				},
+				"bar": nil,
+			},
+		},
+		{
+			name:              "enforce RRO on all",
+			enforceRROTargets: []string{"*"},
+			enforceRROExcludedOverlays: []string{
+				// Excluding specific apps/res directories also allowed.
+				"device/vendor/blah/static_overlay/foo",
+				"device/vendor/blah/static_overlay/bar/res",
+			},
+			overlayFiles: map[string][]string{
+				"foo": []string{
+					buildDir + "/.intermediates/lib/android_common/package-res.apk",
+					"foo/res/res/values/strings.xml",
+					"device/vendor/blah/static_overlay/foo/res/values/strings.xml",
+				},
+				"bar": []string{"device/vendor/blah/static_overlay/bar/res/values/strings.xml"},
+			},
+			rroDirs: map[string][]string{
+				"foo": []string{
+					"device/vendor/blah/overlay/foo/res",
+					"device/vendor/blah/overlay/lib/res",
+				},
+				"bar": []string{"device/vendor/blah/overlay/bar/res"},
+			},
+		},
+	}
+
 	resourceOverlays := []string{
 		"device/vendor/blah/overlay",
 		"device/vendor/blah/overlay2",
@@ -177,8 +195,10 @@
 	fs := map[string][]byte{
 		"foo/res/res/values/strings.xml":                               nil,
 		"bar/res/res/values/strings.xml":                               nil,
+		"lib/res/res/values/strings.xml":                               nil,
 		"device/vendor/blah/overlay/foo/res/values/strings.xml":        nil,
 		"device/vendor/blah/overlay/bar/res/values/strings.xml":        nil,
+		"device/vendor/blah/overlay/lib/res/values/strings.xml":        nil,
 		"device/vendor/blah/static_overlay/foo/res/values/strings.xml": nil,
 		"device/vendor/blah/static_overlay/bar/res/values/strings.xml": nil,
 		"device/vendor/blah/overlay2/res/values/strings.xml":           nil,
@@ -188,15 +208,21 @@
 			android_app {
 				name: "foo",
 				resource_dirs: ["foo/res"],
+				static_libs: ["lib"],
 			}
 
 			android_app {
 				name: "bar",
 				resource_dirs: ["bar/res"],
 			}
+
+			android_library {
+				name: "lib",
+				resource_dirs: ["lib/res"],
+			}
 		`
 
-	for _, testCase := range testEnforceRROTests {
+	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			config := testConfig(nil)
 			config.TestProductVariables.ResourceOverlays = resourceOverlays
@@ -216,7 +242,15 @@
 				var overlayFiles []string
 				if overlayFile.Rule != nil {
 					for _, o := range overlayFile.Inputs.Strings() {
-						overlayFiles = append(overlayFiles, module.Output(o).Inputs.Strings()...)
+						overlayOutput := module.MaybeOutput(o)
+						if overlayOutput.Rule != nil {
+							// If the overlay is compiled as part of this module (i.e. a .arsc.flat file),
+							// verify the inputs to the .arsc.flat rule.
+							overlayFiles = append(overlayFiles, overlayOutput.Inputs.Strings()...)
+						} else {
+							// Otherwise, verify the full path to the output of the other module
+							overlayFiles = append(overlayFiles, o)
+						}
 					}
 				}
 
diff --git a/java/dexpreopt.go b/java/dexpreopt.go
index 6e46bc9..33c46f4 100644
--- a/java/dexpreopt.go
+++ b/java/dexpreopt.go
@@ -15,12 +15,6 @@
 package java
 
 import (
-	"path/filepath"
-	"strings"
-
-	"github.com/google/blueprint"
-	"github.com/google/blueprint/proptools"
-
 	"android/soong/android"
 	"android/soong/dexpreopt"
 )
@@ -87,12 +81,14 @@
 	return false
 }
 
+var dexpreoptGlobalConfigKey = android.NewOnceKey("DexpreoptGlobalConfig")
+
 func (d *dexpreopter) dexpreopt(ctx android.ModuleContext, dexJarFile android.ModuleOutPath) android.ModuleOutPath {
 	if d.dexpreoptDisabled(ctx) {
 		return dexJarFile
 	}
 
-	globalConfig := ctx.Config().Once("DexpreoptGlobalConfig", func() interface{} {
+	globalConfig := ctx.Config().Once(dexpreoptGlobalConfigKey, func() interface{} {
 		if f := ctx.Config().DexpreoptGlobalConfig(); f != "" {
 			ctx.AddNinjaFileDeps(f)
 			globalConfig, err := dexpreopt.LoadGlobalConfig(f)
@@ -185,69 +181,19 @@
 		return dexJarFile
 	}
 
-	var inputs android.Paths
-	for _, input := range dexpreoptRule.Inputs() {
-		if input == "" {
-			// Tests sometimes have empty configuration values that lead to empty inputs
-			continue
-		}
-		rel, isRel := android.MaybeRel(ctx, android.PathForModuleOut(ctx).String(), input)
-		if isRel {
-			inputs = append(inputs, android.PathForModuleOut(ctx, rel))
-		} else {
-			// TODO: use PathForOutput once boot image is moved to where PathForOutput can find it.
-			inputs = append(inputs, &bootImagePath{input})
-		}
-	}
-
-	var outputs android.WritablePaths
-	for _, output := range dexpreoptRule.Outputs() {
-		rel := android.Rel(ctx, android.PathForModuleOut(ctx).String(), output)
-		outputs = append(outputs, android.PathForModuleOut(ctx, rel))
-	}
+	dexpreoptRule.Build(pctx, ctx, "dexpreopt", "dexpreopt")
 
 	for _, install := range dexpreoptRule.Installs() {
 		d.builtInstalled = append(d.builtInstalled, install.From+":"+install.To)
 	}
 
-	if len(dexpreoptRule.Commands()) > 0 {
-		ctx.Build(pctx, android.BuildParams{
-			Rule: ctx.Rule(pctx, "dexpreopt", blueprint.RuleParams{
-				Command:     strings.Join(proptools.NinjaEscape(dexpreoptRule.Commands()), " && "),
-				CommandDeps: dexpreoptRule.Tools(),
-			}),
-			Implicits:   inputs,
-			Outputs:     outputs,
-			Description: "dexpreopt",
-		})
-	}
-
 	stripRule, err := dexpreopt.GenerateStripRule(globalConfig, dexpreoptConfig)
 	if err != nil {
 		ctx.ModuleErrorf("error generating dexpreopt strip rule: %s", err.Error())
 		return dexJarFile
 	}
 
-	ctx.Build(pctx, android.BuildParams{
-		Rule: ctx.Rule(pctx, "dexpreopt_strip", blueprint.RuleParams{
-			Command:     strings.Join(proptools.NinjaEscape(stripRule.Commands()), " && "),
-			CommandDeps: stripRule.Tools(),
-		}),
-		Input:       dexJarFile,
-		Output:      strippedDexJarFile,
-		Description: "dexpreopt strip",
-	})
+	stripRule.Build(pctx, ctx, "dexpreopt_strip", "dexpreopt strip")
 
 	return strippedDexJarFile
 }
-
-type bootImagePath struct {
-	path string
-}
-
-var _ android.Path = (*bootImagePath)(nil)
-
-func (p *bootImagePath) String() string { return p.path }
-func (p *bootImagePath) Ext() string    { return filepath.Ext(p.path) }
-func (p *bootImagePath) Base() string   { return filepath.Base(p.path) }
-func (p *bootImagePath) Rel() string    { return p.path }
diff --git a/java/hiddenapi.go b/java/hiddenapi.go
index 67df575..c7eac73 100644
--- a/java/hiddenapi.go
+++ b/java/hiddenapi.go
@@ -15,6 +15,7 @@
 package java
 
 import (
+	"path/filepath"
 	"sort"
 	"strings"
 	"sync"
@@ -32,7 +33,7 @@
 func hiddenAPIGenerateCSV(ctx android.ModuleContext, classesJar android.Path) {
 	flagsCSV := android.PathForModuleOut(ctx, "hiddenapi", "flags.csv")
 	metadataCSV := android.PathForModuleOut(ctx, "hiddenapi", "metadata.csv")
-	stubFlagsCSV := &bootImagePath{ctx.Config().HiddenAPIStubFlags()}
+	stubFlagsCSV := &hiddenAPIPath{ctx.Config().HiddenAPIStubFlags()}
 
 	ctx.Build(pctx, android.BuildParams{
 		Rule:        hiddenAPIGenerateCSVRule,
@@ -80,7 +81,7 @@
 func hiddenAPIEncodeDex(ctx android.ModuleContext, output android.WritablePath, dexInput android.WritablePath,
 	uncompressDex bool) {
 
-	flagsCsv := &bootImagePath{ctx.Config().HiddenAPIFlags()}
+	flagsCsv := &hiddenAPIPath{ctx.Config().HiddenAPIFlags()}
 
 	// The encode dex rule requires unzipping and rezipping the classes.dex files, ensure that if it was uncompressed
 	// in the input it stays uncompressed in the output.
@@ -120,7 +121,7 @@
 	hiddenAPISaveDexInputs(ctx, dexInput)
 }
 
-const hiddenAPIOutputsKey = "hiddenAPIOutputsKey"
+var hiddenAPIOutputsKey = android.NewOnceKey("hiddenAPIOutputsKey")
 
 var hiddenAPIOutputsLock sync.Mutex
 
@@ -168,3 +169,14 @@
 	export("SOONG_HIDDENAPI_GREYLIST_METADATA", metadataCSVList)
 	export("SOONG_HIDDENAPI_DEX_INPUTS", dexInputList)
 }
+
+type hiddenAPIPath struct {
+	path string
+}
+
+var _ android.Path = (*hiddenAPIPath)(nil)
+
+func (p *hiddenAPIPath) String() string { return p.path }
+func (p *hiddenAPIPath) Ext() string    { return filepath.Ext(p.path) }
+func (p *hiddenAPIPath) Base() string   { return filepath.Base(p.path) }
+func (p *hiddenAPIPath) Rel() string    { return p.path }
diff --git a/java/java.go b/java/java.go
index 70c6c43..d51420c 100644
--- a/java/java.go
+++ b/java/java.go
@@ -531,7 +531,7 @@
 	aidlIncludes = append(aidlIncludes,
 		android.PathsForSource(ctx, j.deviceProperties.Aidl.Include_dirs)...)
 
-	flags := []string{"-b"}
+	flags := []string{}
 
 	if aidlPreprocess.Valid() {
 		flags = append(flags, "-p"+aidlPreprocess.String())
diff --git a/java/sdk.go b/java/sdk.go
index 988610f..0959be7 100644
--- a/java/sdk.go
+++ b/java/sdk.go
@@ -28,7 +28,7 @@
 	android.RegisterPreSingletonType("sdk", sdkSingletonFactory)
 }
 
-const sdkSingletonKey = "sdkSingletonKey"
+var sdkSingletonKey = android.NewOnceKey("sdkSingletonKey")
 
 type sdkContext interface {
 	// sdkVersion eturns the sdk_version property of the current module, or an empty string if it is not set.
diff --git a/java/sdk_library.go b/java/sdk_library.go
index ca3131c..1b0fe75 100644
--- a/java/sdk_library.go
+++ b/java/sdk_library.go
@@ -627,8 +627,10 @@
 	}
 }
 
+var javaSdkLibrariesKey = android.NewOnceKey("javaSdkLibraries")
+
 func javaSdkLibraries(config android.Config) *[]string {
-	return config.Once("javaSdkLibraries", func() interface{} {
+	return config.Once(javaSdkLibrariesKey, func() interface{} {
 		return &[]string{}
 	}).(*[]string)
 }
diff --git a/scripts/strip.sh b/scripts/strip.sh
index d826e57..bedc527 100755
--- a/scripts/strip.sh
+++ b/scripts/strip.sh
@@ -27,7 +27,7 @@
 #   --add-gnu-debuglink
 #   --keep-mini-debug-info
 #   --keep-symbols
-#   --use-llvm-strip
+#   --use-gnu-strip
 
 set -o pipefail
 
@@ -40,12 +40,12 @@
         --add-gnu-debuglink     Add a gnu-debuglink section to out-file
         --keep-mini-debug-info  Keep compressed debug info in out-file
         --keep-symbols          Keep symbols in out-file
-        --use-llvm-strip        Use llvm-{strip,objcopy} instead of strip/objcopy
+        --use-gnu-strip         Use strip/objcopy instead of llvm-{strip,objcopy}
 EOF
     exit 1
 }
 
-# With --use-llvm-strip, GNU strip is replaced with llvm-strip to work around
+# Without --use-gnu-strip, GNU strip is replaced with llvm-strip to work around
 # old GNU strip bug on lld output files, b/80093681.
 # Similary, calls to objcopy are replaced with llvm-objcopy,
 # with some exceptions.
@@ -53,7 +53,7 @@
 do_strip() {
     # ${CROSS_COMPILE}strip --strip-all does not strip .ARM.attributes,
     # so we tell llvm-strip to keep it too.
-    if [ ! -z "${use_llvm_strip}" ]; then
+    if [ -z "${use_gnu_strip}" ]; then
         "${CLANG_BIN}/llvm-strip" --strip-all -keep-section=.ARM.attributes "${infile}" -o "${outfile}.tmp"
     else
         "${CROSS_COMPILE}strip" --strip-all "${infile}" -o "${outfile}.tmp"
@@ -61,10 +61,8 @@
 }
 
 do_strip_keep_symbols() {
-    # Maybe we should replace this objcopy with llvm-objcopy, but
-    # we have not found a use case that is broken by objcopy yet.
     REMOVE_SECTIONS=`"${CROSS_COMPILE}readelf" -S "${infile}" | awk '/.debug_/ {print "--remove-section " $2}' | xargs`
-    if [ ! -z "${use_llvm_strip}" ]; then
+    if [ -z "${use_gnu_strip}" ]; then
         "${CLANG_BIN}/llvm-objcopy" "${infile}" "${outfile}.tmp" ${REMOVE_SECTIONS}
     else
         "${CROSS_COMPILE}objcopy" "${infile}" "${outfile}.tmp" ${REMOVE_SECTIONS}
@@ -74,7 +72,7 @@
 do_strip_keep_mini_debug_info() {
     rm -f "${outfile}.dynsyms" "${outfile}.funcsyms" "${outfile}.keep_symbols" "${outfile}.debug" "${outfile}.mini_debuginfo" "${outfile}.mini_debuginfo.xz"
     local fail=
-    if [ ! -z "${use_llvm_strip}" ]; then
+    if [ -z "${use_gnu_strip}" ]; then
         "${CLANG_BIN}/llvm-strip" --strip-all -keep-section=.ARM.attributes -remove-section=.comment "${infile}" -o "${outfile}.tmp" || fail=true
     else
         "${CROSS_COMPILE}strip" --strip-all -R .comment "${infile}" -o "${outfile}.tmp" || fail=true
@@ -93,7 +91,7 @@
         "${CROSS_COMPILE}objcopy" -S --remove-section .gdb_index --remove-section .comment --keep-symbols="${outfile}.keep_symbols" "${outfile}.mini_debuginfo"
         "${CROSS_COMPILE}objcopy" --rename-section saved_debug_frame=.debug_frame "${outfile}.mini_debuginfo"
         "${XZ}" "${outfile}.mini_debuginfo"
-        if [ ! -z "${use_llvm_strip}" ]; then
+        if [ -z "${use_gnu_strip}" ]; then
             "${CLANG_BIN}/llvm-objcopy" --add-section .gnu_debugdata="${outfile}.mini_debuginfo.xz" "${outfile}.tmp"
         else
             "${CROSS_COMPILE}objcopy" --add-section .gnu_debugdata="${outfile}.mini_debuginfo.xz" "${outfile}.tmp"
@@ -105,7 +103,7 @@
 }
 
 do_add_gnu_debuglink() {
-    if [ ! -z "${use_llvm_strip}" ]; then
+    if [ -z "${use_gnu_strip}" ]; then
         "${CLANG_BIN}/llvm-objcopy" --add-gnu-debuglink="${infile}" "${outfile}.tmp"
     else
         "${CROSS_COMPILE}objcopy" --add-gnu-debuglink="${infile}" "${outfile}.tmp"
@@ -122,7 +120,7 @@
 		add-gnu-debuglink) add_gnu_debuglink=true ;;
 		keep-mini-debug-info) keep_mini_debug_info=true ;;
 		keep-symbols) keep_symbols=true ;;
-		use-llvm-strip) use_llvm_strip=true ;;
+		use-gnu-strip) use_gnu_strip=true ;;
 		*) echo "Unknown option --${OPTARG}"; usage ;;
 	    esac;;
 	?) usage ;;
@@ -172,7 +170,7 @@
 rm -f "${outfile}"
 mv "${outfile}.tmp" "${outfile}"
 
-if [ ! -z "${use_llvm_strip}" ]; then
+if [ -z "${use_gnu_strip}" ]; then
   USED_STRIP_OBJCOPY="${CLANG_BIN}/llvm-strip ${CLANG_BIN}/llvm-objcopy"
 else
   USED_STRIP_OBJCOPY="${CROSS_COMPILE}strip"
diff --git a/ui/build/kati.go b/ui/build/kati.go
index f924b9c..959d0bd 100644
--- a/ui/build/kati.go
+++ b/ui/build/kati.go
@@ -202,8 +202,11 @@
 	defer ctx.EndTrace()
 
 	runKati(ctx, config, katiCleanspecSuffix, []string{
+		"--werror_writable",
 		"--werror_implicit_rules",
 		"--werror_overriding_commands",
+		"--werror_real_to_phony",
+		"--werror_phony_looks_real",
 		"-f", "build/make/core/cleanbuild.mk",
 		"SOONG_MAKEVARS_MK=" + config.SoongMakeVarsMk(),
 		"TARGET_DEVICE_DIR=" + config.TargetDeviceDir(),