diff --git a/cc/binary.go b/cc/binary.go
index fd00060..17e729c 100644
--- a/cc/binary.go
+++ b/cc/binary.go
@@ -50,6 +50,9 @@
 	// binaries would be installed by default (in PRODUCT_PACKAGES) the other binary will be removed
 	// from PRODUCT_PACKAGES.
 	Overrides []string
+
+	// Inject boringssl hash into the shared library.  This is only intended for use by external/boringssl.
+	Inject_bssl_hash *bool `android:"arch_variant"`
 }
 
 func init() {
@@ -342,6 +345,8 @@
 			flagsToBuilderFlags(flags), afterPrefixSymbols)
 	}
 
+	outputFile = maybeInjectBoringSSLHash(ctx, outputFile, binary.Properties.Inject_bssl_hash, fileName)
+
 	if Bool(binary.baseLinker.Properties.Use_version_lib) {
 		if ctx.Host() {
 			versionedOutputFile := outputFile
diff --git a/cc/builder.go b/cc/builder.go
index 554706c..42d809a 100644
--- a/cc/builder.go
+++ b/cc/builder.go
@@ -551,7 +551,7 @@
 	flags builderFlags, outputFile android.ModuleOutPath, deps android.Paths) {
 
 	arCmd := "${config.ClangBin}/llvm-ar"
-	arFlags := "crsD"
+	arFlags := "crsPD"
 	if !ctx.Darwin() {
 		arFlags += " -format=gnu"
 	}
diff --git a/cc/library.go b/cc/library.go
index 52fd346..9178a52 100644
--- a/cc/library.go
+++ b/cc/library.go
@@ -771,18 +771,7 @@
 	}
 	library.unstrippedOutputFile = outputFile
 
-	// TODO(b/137267623): Remove this in favor of a cc_genrule when they support operating on shared libraries.
-	if Bool(library.Properties.Inject_bssl_hash) {
-		hashedOutputfile := outputFile
-		outputFile = android.PathForModuleOut(ctx, "unhashed", fileName)
-
-		rule := android.NewRuleBuilder()
-		rule.Command().
-			BuiltTool(ctx, "bssl_inject_hash").
-			FlagWithInput("-in-object ", outputFile).
-			FlagWithOutput("-o ", hashedOutputfile)
-		rule.Build(pctx, ctx, "injectCryptoHash", "inject crypto hash")
-	}
+	outputFile = maybeInjectBoringSSLHash(ctx, outputFile, library.Properties.Inject_bssl_hash, fileName)
 
 	if Bool(library.baseLinker.Properties.Use_version_lib) {
 		if ctx.Host() {
@@ -1296,3 +1285,38 @@
 		}
 	}
 }
+
+// maybeInjectBoringSSLHash adds a rule to run bssl_inject_hash on the output file if the module has the
+// inject_bssl_hash or if any static library dependencies have inject_bssl_hash set.  It returns the output path
+// that the linked output file should be written to.
+// TODO(b/137267623): Remove this in favor of a cc_genrule when they support operating on shared libraries.
+func maybeInjectBoringSSLHash(ctx android.ModuleContext, outputFile android.ModuleOutPath,
+	inject *bool, fileName string) android.ModuleOutPath {
+	// TODO(b/137267623): Remove this in favor of a cc_genrule when they support operating on shared libraries.
+	injectBoringSSLHash := Bool(inject)
+	ctx.VisitDirectDeps(func(dep android.Module) {
+		tag := ctx.OtherModuleDependencyTag(dep)
+		if tag == staticDepTag || tag == staticExportDepTag || tag == wholeStaticDepTag || tag == lateStaticDepTag {
+			if cc, ok := dep.(*Module); ok {
+				if library, ok := cc.linker.(*libraryDecorator); ok {
+					if Bool(library.Properties.Inject_bssl_hash) {
+						injectBoringSSLHash = true
+					}
+				}
+			}
+		}
+	})
+	if injectBoringSSLHash {
+		hashedOutputfile := outputFile
+		outputFile = android.PathForModuleOut(ctx, "unhashed", fileName)
+
+		rule := android.NewRuleBuilder()
+		rule.Command().
+			BuiltTool(ctx, "bssl_inject_hash").
+			FlagWithInput("-in-object ", outputFile).
+			FlagWithOutput("-o ", hashedOutputfile)
+		rule.Build(pctx, ctx, "injectCryptoHash", "inject crypto hash")
+	}
+
+	return outputFile
+}
diff --git a/cc/vndk.go b/cc/vndk.go
index 2a86f5b..698fab5 100644
--- a/cc/vndk.go
+++ b/cc/vndk.go
@@ -317,10 +317,13 @@
 	if !ok {
 		return
 	}
-
 	if !m.Enabled() {
 		return
 	}
+	if m.Target().NativeBridge == android.NativeBridgeEnabled {
+		// Skip native_bridge modules
+		return
+	}
 
 	if m.isVndk() {
 		if lib, ok := m.linker.(*vndkPrebuiltLibraryDecorator); ok {
diff --git a/java/builder.go b/java/builder.go
index f174cf0..9e068fa 100644
--- a/java/builder.go
+++ b/java/builder.go
@@ -229,10 +229,9 @@
 
 // Emits the rule to generate Xref input file (.kzip file) for the given set of source files and source jars
 // to compile with given set of builder flags, etc.
-func emitXrefRule(ctx android.ModuleContext, xrefFile android.WritablePath,
+func emitXrefRule(ctx android.ModuleContext, xrefFile android.WritablePath, idx int,
 	srcFiles, srcJars android.Paths,
-	flags javaBuilderFlags, deps android.Paths,
-	intermediatesDir string) {
+	flags javaBuilderFlags, deps android.Paths) {
 
 	deps = append(deps, srcJars...)
 
@@ -260,6 +259,11 @@
 		processor = "-processor " + flags.processor
 	}
 
+	intermediatesDir := "xref"
+	if idx >= 0 {
+		intermediatesDir += strconv.Itoa(idx)
+	}
+
 	ctx.Build(pctx,
 		android.BuildParams{
 			Rule:        kytheExtract,
diff --git a/java/java.go b/java/java.go
index 87ee2f2..b05d7bb 100644
--- a/java/java.go
+++ b/java/java.go
@@ -25,6 +25,7 @@
 	"strings"
 
 	"github.com/google/blueprint"
+	"github.com/google/blueprint/pathtools"
 	"github.com/google/blueprint/proptools"
 
 	"android/soong/android"
@@ -1151,27 +1152,20 @@
 			if len(uniqueSrcFiles) > 0 {
 				shardSrcs = shardPaths(uniqueSrcFiles, shardSize)
 				for idx, shardSrc := range shardSrcs {
-					classes := android.PathForModuleOut(ctx, "javac", jarName+strconv.Itoa(idx))
-					TransformJavaToClasses(ctx, classes, idx, shardSrc, nil, flags, extraJarDeps)
+					classes := j.compileJavaClasses(ctx, jarName, idx, shardSrc,
+						nil, flags, extraJarDeps)
 					jars = append(jars, classes)
 				}
 			}
 			if len(srcJars) > 0 {
-				classes := android.PathForModuleOut(ctx, "javac", jarName+strconv.Itoa(len(shardSrcs)))
-				TransformJavaToClasses(ctx, classes, len(shardSrcs), nil, srcJars, flags, extraJarDeps)
+				classes := j.compileJavaClasses(ctx, jarName, len(shardSrcs),
+					nil, srcJars, flags, extraJarDeps)
 				jars = append(jars, classes)
 			}
 		} else {
-			classes := android.PathForModuleOut(ctx, "javac", jarName)
-			TransformJavaToClasses(ctx, classes, -1, uniqueSrcFiles, srcJars, flags, extraJarDeps)
+			classes := j.compileJavaClasses(ctx, jarName, -1, uniqueSrcFiles, srcJars, flags, extraJarDeps)
 			jars = append(jars, classes)
 		}
-		if ctx.Config().EmitXrefRules() {
-			extractionFile := android.PathForModuleOut(ctx, ctx.ModuleName()+".kzip")
-			emitXrefRule(ctx, extractionFile, uniqueSrcFiles, srcJars, flags, extraJarDeps, "xref")
-			j.kytheFiles = append(j.kytheFiles, extractionFile)
-
-		}
 		if ctx.Failed() {
 			return
 		}
@@ -1392,6 +1386,27 @@
 	j.outputFile = outputFile.WithoutRel()
 }
 
+func (j *Module) compileJavaClasses(ctx android.ModuleContext, jarName string, idx int,
+	srcFiles, srcJars android.Paths, flags javaBuilderFlags, extraJarDeps android.Paths) android.WritablePath {
+
+	kzipName := pathtools.ReplaceExtension(jarName, "kzip")
+	if idx >= 0 {
+		kzipName = strings.TrimSuffix(jarName, filepath.Ext(jarName)) + strconv.Itoa(idx) + ".kzip"
+		jarName += strconv.Itoa(idx)
+	}
+
+	classes := android.PathForModuleOut(ctx, "javac", jarName)
+	TransformJavaToClasses(ctx, classes, idx, srcFiles, srcJars, flags, extraJarDeps)
+
+	if ctx.Config().EmitXrefRules() {
+		extractionFile := android.PathForModuleOut(ctx, kzipName)
+		emitXrefRule(ctx, extractionFile, idx, srcFiles, srcJars, flags, extraJarDeps)
+		j.kytheFiles = append(j.kytheFiles, extractionFile)
+	}
+
+	return classes
+}
+
 // Check for invalid kotlinc flags. Only use this for flags explicitly passed by the user,
 // since some of these flags may be used internally.
 func CheckKotlincFlags(ctx android.ModuleContext, flags []string) {
diff --git a/java/sdk.go b/java/sdk.go
index d1e2ae4..3451774 100644
--- a/java/sdk.go
+++ b/java/sdk.go
@@ -19,7 +19,6 @@
 	"android/soong/java/config"
 	"fmt"
 	"path/filepath"
-	"runtime"
 	"sort"
 	"strconv"
 	"strings"
@@ -349,15 +348,7 @@
 
 		cmd.Text("cat").
 			Inputs(android.PathsForSource(ctx, in)).
-			Text("|")
-
-		if runtime.GOOS == "darwin" {
-			cmd.Text("md5")
-		} else {
-			cmd.Text("md5sum")
-		}
-
-		cmd.Text("| cut -d' ' -f1 >").
+			Text("| md5sum | cut -d' ' -f1 >").
 			Output(out)
 	} else {
 		// Unbundled build
diff --git a/rust/rust.go b/rust/rust.go
index 5a2514e..62ccfc7 100644
--- a/rust/rust.go
+++ b/rust/rust.go
@@ -173,6 +173,24 @@
 
 	android.InitDefaultableModule(mod)
 
+	// Explicitly disable unsupported targets.
+	android.AddLoadHook(mod, func(ctx android.LoadHookContext) {
+		disableTargets := struct {
+			Target struct {
+				Darwin struct {
+					Enabled *bool
+				}
+				Linux_bionic struct {
+					Enabled *bool
+				}
+			}
+		}{}
+		disableTargets.Target.Darwin.Enabled = proptools.BoolPtr(false)
+		disableTargets.Target.Linux_bionic.Enabled = proptools.BoolPtr(false)
+
+		ctx.AppendProperties(&disableTargets)
+	})
+
 	return mod
 }
 
diff --git a/ui/build/paths/config.go b/ui/build/paths/config.go
index b97391b..786e7d3 100644
--- a/ui/build/paths/config.go
+++ b/ui/build/paths/config.go
@@ -129,12 +129,10 @@
 
 func init() {
 	if runtime.GOOS == "darwin" {
-		// TODO: move Darwin off md5 and onto our md5sum prebuilt.
-		Configuration["md5"] = Allowed
 		Configuration["sw_vers"] = Allowed
 		Configuration["xcrun"] = Allowed
 
-		// We don't have darwin prebuilts for some tools (like toybox),
+		// We don't have darwin prebuilts for some tools,
 		// so allow the host versions.
 		for name, config := range Configuration {
 			if config.LinuxOnlyPrebuilt {