diff --git a/payload_consumer/certificate_parser_android_unittest.cc b/payload_consumer/certificate_parser_android_unittest.cc
index e300414..9603f96 100644
--- a/payload_consumer/certificate_parser_android_unittest.cc
+++ b/payload_consumer/certificate_parser_android_unittest.cc
@@ -21,15 +21,15 @@
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
-#include "update_engine/common/hash_calculator.h"
 #include "update_engine/common/test_utils.h"
+#include "update_engine/common/testing_constants.h"
+#include "update_engine/common/hash_calculator.h"
 #include "update_engine/common/utils.h"
 #include "update_engine/payload_consumer/payload_verifier.h"
 #include "update_engine/payload_generator/payload_signer.h"
 
 namespace chromeos_update_engine {
 
-extern const char* kUnittestPrivateKeyPath;
 const char* kUnittestOtacertsPath = "otacerts.zip";
 
 TEST(CertificateParserAndroidTest, ParseZipArchive) {
diff --git a/payload_consumer/delta_performer.cc b/payload_consumer/delta_performer.cc
index 274465c..a383bf6 100644
--- a/payload_consumer/delta_performer.cc
+++ b/payload_consumer/delta_performer.cc
@@ -247,8 +247,8 @@
       IsDynamicPartition(install_part.name, install_plan_->target_slot));
   // Open source fds if we have a delta payload, or for partitions in the
   // partial update.
-  bool source_may_exist = manifest_.partial_update() ||
-                          payload_->type == InstallPayloadType::kDelta;
+  const bool source_may_exist = manifest_.partial_update() ||
+                                payload_->type == InstallPayloadType::kDelta;
   const size_t partition_operation_num = GetPartitionOperationNum();
 
   TEST_AND_RETURN_FALSE(partition_writer_->Init(
@@ -1146,9 +1146,12 @@
   // Verifies the payload hash.
   TEST_AND_RETURN_VAL(ErrorCode::kDownloadPayloadVerificationError,
                       !payload_hash_calculator_.raw_hash().empty());
-  TEST_AND_RETURN_VAL(
-      ErrorCode::kPayloadHashMismatchError,
-      payload_hash_calculator_.raw_hash() == update_check_response_hash);
+  if (payload_hash_calculator_.raw_hash() != update_check_response_hash) {
+    LOG(ERROR) << "Actual hash: "
+               << HexEncode(payload_hash_calculator_.raw_hash())
+               << ", expected hash: " << HexEncode(update_check_response_hash);
+    return ErrorCode::kPayloadHashMismatchError;
+  }
 
   // NOLINTNEXTLINE(whitespace/braces)
   auto [payload_verifier, perform_verification] = CreatePayloadVerifier();
diff --git a/payload_consumer/delta_performer_integration_test.cc b/payload_consumer/delta_performer_integration_test.cc
index a72b8ae..34e4c90 100644
--- a/payload_consumer/delta_performer_integration_test.cc
+++ b/payload_consumer/delta_performer_integration_test.cc
@@ -41,6 +41,7 @@
 #include "update_engine/common/mock_download_action.h"
 #include "update_engine/common/mock_prefs.h"
 #include "update_engine/common/test_utils.h"
+#include "update_engine/common/testing_constants.h"
 #include "update_engine/common/utils.h"
 #include "update_engine/payload_consumer/install_plan.h"
 #include "update_engine/payload_consumer/payload_constants.h"
@@ -66,13 +67,6 @@
 using testing::Not;
 using testing::Return;
 
-extern const char* kUnittestPrivateKeyPath;
-extern const char* kUnittestPublicKeyPath;
-extern const char* kUnittestPrivateKey2Path;
-extern const char* kUnittestPublicKey2Path;
-extern const char* kUnittestPrivateKeyECPath;
-extern const char* kUnittestPublicKeyECPath;
-
 static const uint32_t kDefaultKernelSize = 4096;  // Something small for a test
 // clang-format off
 static const uint8_t kNewData[] = {'T', 'h', 'i', 's', ' ', 'i', 's', ' ',
diff --git a/payload_consumer/delta_performer_unittest.cc b/payload_consumer/delta_performer_unittest.cc
index c24c524..bd4850a 100644
--- a/payload_consumer/delta_performer_unittest.cc
+++ b/payload_consumer/delta_performer_unittest.cc
@@ -47,6 +47,7 @@
 #include "update_engine/common/hash_calculator.h"
 #include "update_engine/common/mock_download_action.h"
 #include "update_engine/common/test_utils.h"
+#include "update_engine/common/testing_constants.h"
 #include "update_engine/common/utils.h"
 #include "update_engine/payload_consumer/fake_file_descriptor.h"
 #include "update_engine/payload_consumer/mock_partition_writer.h"
@@ -68,9 +69,6 @@
 using testing::Return;
 using ::testing::Sequence;
 
-extern const char* kUnittestPrivateKeyPath;
-extern const char* kUnittestPublicKeyPath;
-
 namespace {
 
 const char kBogusMetadataSignature1[] =