Merge "Support setting android:usesNonSdkApi in manifest_fixer.py"
diff --git a/android/arch.go b/android/arch.go
index d84c829..6971bc8 100644
--- a/android/arch.go
+++ b/android/arch.go
@@ -201,7 +201,7 @@
 	osArchTypeMap = map[OsType][]ArchType{
 		Linux:       []ArchType{X86, X86_64},
 		LinuxBionic: []ArchType{X86_64},
-		Darwin:      []ArchType{X86, X86_64},
+		Darwin:      []ArchType{X86_64},
 		Windows:     []ArchType{X86, X86_64},
 		Android:     []ArchType{Arm, Arm64, Mips, Mips64, X86, X86_64},
 	}
diff --git a/android/module.go b/android/module.go
index a058199..77765f1 100644
--- a/android/module.go
+++ b/android/module.go
@@ -1067,6 +1067,16 @@
 	return a.kind == productServicesSpecificModule
 }
 
+// Makes this module a platform module, i.e. not specific to soc, device,
+// product, or product_services.
+func (a *ModuleBase) MakeAsPlatform() {
+	a.commonProperties.Vendor = boolPtr(false)
+	a.commonProperties.Proprietary = boolPtr(false)
+	a.commonProperties.Soc_specific = boolPtr(false)
+	a.commonProperties.Product_specific = boolPtr(false)
+	a.commonProperties.Product_services_specific = boolPtr(false)
+}
+
 func (a *androidModuleContext) InstallInData() bool {
 	return a.module.InstallInData()
 }
diff --git a/android/mutator.go b/android/mutator.go
index 64d9fdd..b9c44e8 100644
--- a/android/mutator.go
+++ b/android/mutator.go
@@ -205,7 +205,7 @@
 }
 
 func depsMutator(ctx BottomUpMutatorContext) {
-	if m, ok := ctx.Module().(Module); ok {
+	if m, ok := ctx.Module().(Module); ok && m.Enabled() {
 		m.DepsMutator(ctx)
 	}
 }
diff --git a/cc/builder.go b/cc/builder.go
index 7d207b0..be63fd7 100644
--- a/cc/builder.go
+++ b/cc/builder.go
@@ -150,12 +150,10 @@
 		},
 		"crossCompile")
 
-	_ = pctx.SourcePathVariable("tidyPath", "build/soong/scripts/clang-tidy.sh")
-
 	clangTidy = pctx.AndroidStaticRule("clangTidy",
 		blueprint.RuleParams{
-			Command:     "rm -f $out && CLANG_TIDY=${config.ClangBin}/clang-tidy $tidyPath $tidyFlags $in -- $cFlags && touch $out",
-			CommandDeps: []string{"${config.ClangBin}/clang-tidy", "$tidyPath"},
+			Command:     "rm -f $out && CLANG_TIDY=${config.ClangBin}/clang-tidy ${config.ClangTidyShellPath} $tidyFlags $in -- $cFlags && touch $out",
+			CommandDeps: []string{"${config.ClangBin}/clang-tidy", "${config.ClangTidyShellPath}"},
 		},
 		"cFlags", "tidyFlags")
 
diff --git a/cc/cc.go b/cc/cc.go
index 7f65640..2d967ed 100644
--- a/cc/cc.go
+++ b/cc/cc.go
@@ -585,6 +585,9 @@
 	if inList(ctx.baseModuleName(), llndkLibraries) {
 		return true
 	}
+	if inList(ctx.baseModuleName(), ndkMigratedLibs) {
+		return true
+	}
 	if ctx.useVndk() && ctx.isVndk() {
 		// Return true if this is VNDK-core, VNDK-SP, or VNDK-Ext and this is not
 		// VNDK-private.
@@ -922,10 +925,6 @@
 }
 
 func (c *Module) DepsMutator(actx android.BottomUpMutatorContext) {
-	if !c.Enabled() {
-		return
-	}
-
 	ctx := &depsContext{
 		BottomUpMutatorContext: actx,
 		moduleContextImpl: moduleContextImpl{
@@ -1043,13 +1042,13 @@
 		actx.AddDependency(c, depTag, gen)
 	}
 
-	actx.AddDependency(c, objDepTag, deps.ObjFiles...)
+	actx.AddVariationDependencies(nil, objDepTag, deps.ObjFiles...)
 
 	if deps.CrtBegin != "" {
-		actx.AddDependency(c, crtBeginDepTag, deps.CrtBegin)
+		actx.AddVariationDependencies(nil, crtBeginDepTag, deps.CrtBegin)
 	}
 	if deps.CrtEnd != "" {
-		actx.AddDependency(c, crtEndDepTag, deps.CrtEnd)
+		actx.AddVariationDependencies(nil, crtEndDepTag, deps.CrtEnd)
 	}
 	if deps.LinkerScript != "" {
 		actx.AddDependency(c, linkerScriptDepTag, deps.LinkerScript)
@@ -1741,6 +1740,7 @@
 		} else if v == recoveryMode {
 			m := mod[i].(*Module)
 			m.Properties.InRecovery = true
+			m.MakeAsPlatform()
 			squashRecoverySrcs(m)
 		}
 	}
diff --git a/cc/cc_test.go b/cc/cc_test.go
index 3d162e7..3d5dfb1 100644
--- a/cc/cc_test.go
+++ b/cc/cc_test.go
@@ -158,11 +158,13 @@
 		cc_object {
 			name: "crtbegin_so",
 			recovery_available: true,
+			vendor_available: true,
 		}
 
 		cc_object {
 			name: "crtend_so",
 			recovery_available: true,
+			vendor_available: true,
 		}
 
 		cc_library {
@@ -236,8 +238,9 @@
 }
 
 const (
-	coreVariant   = "android_arm64_armv8-a_core_shared"
-	vendorVariant = "android_arm64_armv8-a_vendor_shared"
+	coreVariant     = "android_arm64_armv8-a_core_shared"
+	vendorVariant   = "android_arm64_armv8-a_vendor_shared"
+	recoveryVariant = "android_arm64_armv8-a_recovery_shared"
 )
 
 func TestVendorSrc(t *testing.T) {
@@ -1674,6 +1677,11 @@
 			recovery: true,
 			compile_multilib:"32",
 		}
+		cc_library_shared {
+			name: "libHalInRecovery",
+			recovery_available: true,
+			vendor: true,
+		}
 	`)
 
 	variants := ctx.ModuleVariantsForTests("librecovery")
@@ -1686,4 +1694,10 @@
 	if android.InList(arm64, variants) {
 		t.Errorf("multilib was set to 32 for librecovery32, but its variants has %s.", arm64)
 	}
+
+	recoveryModule := ctx.ModuleForTests("libHalInRecovery", recoveryVariant).Module().(*Module)
+	if !recoveryModule.Platform() {
+		t.Errorf("recovery variant of libHalInRecovery must not specific to device, soc, or product")
+	}
+
 }
diff --git a/cc/config/global.go b/cc/config/global.go
index a49e509..8b02f02 100644
--- a/cc/config/global.go
+++ b/cc/config/global.go
@@ -209,6 +209,7 @@
 	})
 	pctx.StaticVariable("ClangPath", "${ClangBase}/${HostPrebuiltTag}/${ClangVersion}")
 	pctx.StaticVariable("ClangBin", "${ClangPath}/bin")
+	pctx.StaticVariable("ClangTidyShellPath", "build/soong/scripts/clang-tidy.sh")
 
 	pctx.VariableFunc("ClangShortVersion", func(ctx android.PackageVarContext) string {
 		if override := ctx.Config().Getenv("LLVM_RELEASE_VERSION"); override != "" {
diff --git a/cc/config/x86_darwin_host.go b/cc/config/x86_darwin_host.go
index 4ec2b31..694137d 100644
--- a/cc/config/x86_darwin_host.go
+++ b/cc/config/x86_darwin_host.go
@@ -37,28 +37,14 @@
 		"-isysroot ${macSdkRoot}",
 		"-mmacosx-version-min=${macMinVersion}",
 		"-DMACOSX_DEPLOYMENT_TARGET=${macMinVersion}",
+
+		"-m64",
 	}
 
 	darwinLdflags = []string{
 		"-isysroot ${macSdkRoot}",
 		"-Wl,-syslibroot,${macSdkRoot}",
 		"-mmacosx-version-min=${macMinVersion}",
-	}
-
-	// Extended cflags
-	darwinX86Cflags = []string{
-		"-m32",
-	}
-
-	darwinX8664Cflags = []string{
-		"-m64",
-	}
-
-	darwinX86Ldflags = []string{
-		"-m32",
-	}
-
-	darwinX8664Ldflags = []string{
 		"-m64",
 	}
 
@@ -67,27 +53,16 @@
 		"-fstack-protector-strong",
 	}...)
 
-	darwinX86ClangCflags = append(ClangFilterUnknownCflags(darwinX86Cflags), []string{
-		"-msse3",
-	}...)
-
 	darwinClangLdflags = ClangFilterUnknownCflags(darwinLdflags)
 
 	darwinClangLldflags = ClangFilterUnknownLldflags(darwinClangLdflags)
 
-	darwinX86ClangLdflags = ClangFilterUnknownCflags(darwinX86Ldflags)
-
-	darwinX86ClangLldflags = ClangFilterUnknownLldflags(darwinX86ClangLdflags)
-
-	darwinX8664ClangLdflags = ClangFilterUnknownCflags(darwinX8664Ldflags)
-
-	darwinX8664ClangLldflags = ClangFilterUnknownLldflags(darwinX8664ClangLdflags)
-
 	darwinSupportedSdkVersions = []string{
 		"10.10",
 		"10.11",
 		"10.12",
 		"10.13",
+		"10.14",
 	}
 
 	darwinAvailableLibraries = append(
@@ -149,21 +124,7 @@
 	pctx.StaticVariable("DarwinClangLdflags", strings.Join(darwinClangLdflags, " "))
 	pctx.StaticVariable("DarwinClangLldflags", strings.Join(darwinClangLldflags, " "))
 
-	// Extended cflags
-	pctx.StaticVariable("DarwinX86Cflags", strings.Join(darwinX86Cflags, " "))
-	pctx.StaticVariable("DarwinX8664Cflags", strings.Join(darwinX8664Cflags, " "))
-	pctx.StaticVariable("DarwinX86Ldflags", strings.Join(darwinX86Ldflags, " "))
-	pctx.StaticVariable("DarwinX8664Ldflags", strings.Join(darwinX8664Ldflags, " "))
-
-	pctx.StaticVariable("DarwinX86ClangCflags", strings.Join(darwinX86ClangCflags, " "))
-	pctx.StaticVariable("DarwinX8664ClangCflags",
-		strings.Join(ClangFilterUnknownCflags(darwinX8664Cflags), " "))
-	pctx.StaticVariable("DarwinX86ClangLdflags", strings.Join(darwinX86ClangLdflags, " "))
-	pctx.StaticVariable("DarwinX86ClangLldflags", strings.Join(darwinX86ClangLldflags, " "))
-	pctx.StaticVariable("DarwinX8664ClangLdflags", strings.Join(darwinX8664ClangLdflags, " "))
-	pctx.StaticVariable("DarwinX8664ClangLldflags", strings.Join(darwinX8664ClangLldflags, " "))
-	pctx.StaticVariable("DarwinX86YasmFlags", "-f macho -m x86")
-	pctx.StaticVariable("DarwinX8664YasmFlags", "-f macho -m amd64")
+	pctx.StaticVariable("DarwinYasmFlags", "-f macho -m amd64")
 }
 
 func xcrun(ctx android.PackageVarContext, args ...string) string {
@@ -202,23 +163,10 @@
 
 type toolchainDarwin struct {
 	cFlags, ldFlags string
-}
-
-type toolchainDarwinX86 struct {
-	toolchain32Bit
-	toolchainDarwin
-}
-
-type toolchainDarwinX8664 struct {
 	toolchain64Bit
-	toolchainDarwin
 }
 
-func (t *toolchainDarwinX86) Name() string {
-	return "x86"
-}
-
-func (t *toolchainDarwinX8664) Name() string {
+func (t *toolchainDarwin) Name() string {
 	return "x86_64"
 }
 
@@ -235,71 +183,43 @@
 }
 
 func (t *toolchainDarwin) Cflags() string {
-	return "${config.DarwinCflags} ${config.DarwinX86Cflags}"
-}
-
-func (t *toolchainDarwinX8664) Cflags() string {
-	return "${config.DarwinCflags} ${config.DarwinX8664Cflags}"
+	return "${config.DarwinCflags}"
 }
 
 func (t *toolchainDarwin) Cppflags() string {
 	return ""
 }
 
-func (t *toolchainDarwinX86) Ldflags() string {
-	return "${config.DarwinLdflags} ${config.DarwinX86Ldflags}"
-}
-
-func (t *toolchainDarwinX8664) Ldflags() string {
-	return "${config.DarwinLdflags} ${config.DarwinX8664Ldflags}"
+func (t *toolchainDarwin) Ldflags() string {
+	return "${config.DarwinLdflags}"
 }
 
 func (t *toolchainDarwin) IncludeFlags() string {
 	return ""
 }
 
-func (t *toolchainDarwinX86) ClangTriple() string {
-	return "i686-apple-darwin"
-}
-
-func (t *toolchainDarwinX86) ClangCflags() string {
-	return "${config.DarwinClangCflags} ${config.DarwinX86ClangCflags}"
-}
-
-func (t *toolchainDarwinX8664) ClangTriple() string {
+func (t *toolchainDarwin) ClangTriple() string {
 	return "x86_64-apple-darwin"
 }
 
-func (t *toolchainDarwinX8664) ClangCflags() string {
-	return "${config.DarwinClangCflags} ${config.DarwinX8664ClangCflags}"
+func (t *toolchainDarwin) ClangCflags() string {
+	return "${config.DarwinClangCflags}"
 }
 
 func (t *toolchainDarwin) ClangCppflags() string {
 	return ""
 }
 
-func (t *toolchainDarwinX86) ClangLdflags() string {
-	return "${config.DarwinClangLdflags} ${config.DarwinX86ClangLdflags}"
+func (t *toolchainDarwin) ClangLdflags() string {
+	return "${config.DarwinClangLdflags}"
 }
 
-func (t *toolchainDarwinX86) ClangLldflags() string {
-	return "${config.DarwinClangLldflags} ${config.DarwinX86ClangLldflags}"
+func (t *toolchainDarwin) ClangLldflags() string {
+	return "${config.DarwinClangLldflags}"
 }
 
-func (t *toolchainDarwinX8664) ClangLdflags() string {
-	return "${config.DarwinClangLdflags} ${config.DarwinX8664ClangLdflags}"
-}
-
-func (t *toolchainDarwinX8664) ClangLldflags() string {
-	return "${config.DarwinClangLldflags} ${config.DarwinX8664ClangLldflags}"
-}
-
-func (t *toolchainDarwinX86) YasmFlags() string {
-	return "${config.DarwinX86YasmFlags}"
-}
-
-func (t *toolchainDarwinX8664) YasmFlags() string {
-	return "${config.DarwinX8664YasmFlags}"
+func (t *toolchainDarwin) YasmFlags() string {
+	return "${config.DarwinYasmFlags}"
 }
 
 func (t *toolchainDarwin) ShlibSuffix() string {
@@ -318,18 +238,12 @@
 	return "${config.MacToolPath}"
 }
 
-var toolchainDarwinX86Singleton Toolchain = &toolchainDarwinX86{}
-var toolchainDarwinX8664Singleton Toolchain = &toolchainDarwinX8664{}
+var toolchainDarwinSingleton Toolchain = &toolchainDarwin{}
 
-func darwinX86ToolchainFactory(arch android.Arch) Toolchain {
-	return toolchainDarwinX86Singleton
-}
-
-func darwinX8664ToolchainFactory(arch android.Arch) Toolchain {
-	return toolchainDarwinX8664Singleton
+func darwinToolchainFactory(arch android.Arch) Toolchain {
+	return toolchainDarwinSingleton
 }
 
 func init() {
-	registerToolchainFactory(android.Darwin, android.X86, darwinX86ToolchainFactory)
-	registerToolchainFactory(android.Darwin, android.X86_64, darwinX8664ToolchainFactory)
+	registerToolchainFactory(android.Darwin, android.X86_64, darwinToolchainFactory)
 }
diff --git a/cc/config/x86_windows_host.go b/cc/config/x86_windows_host.go
index 4cb8fa4..9003e85 100644
--- a/cc/config/x86_windows_host.go
+++ b/cc/config/x86_windows_host.go
@@ -62,6 +62,8 @@
 
 	windowsLdflags = []string{
 		"--enable-stdcall-fixup",
+		"-Wl,--dynamicbase",
+		"-Wl,--nxcompat",
 	}
 	windowsClangLdflags  = append(ClangFilterUnknownCflags(windowsLdflags), []string{}...)
 	windowsClangLldflags = ClangFilterUnknownLldflags(windowsClangLdflags)
@@ -96,6 +98,7 @@
 		"-m64",
 		"-L${WindowsGccRoot}/${WindowsGccTriple}/lib64",
 		"-static-libgcc",
+		"-Wl,--high-entropy-va",
 	}
 	windowsX8664ClangLdflags = append(ClangFilterUnknownCflags(windowsX8664Ldflags), []string{
 		"-B${WindowsGccRoot}/${WindowsGccTriple}/bin",
diff --git a/cc/library.go b/cc/library.go
index 147dd8e..7ff7885 100644
--- a/cc/library.go
+++ b/cc/library.go
@@ -604,7 +604,7 @@
 }
 
 func getRefAbiDumpFile(ctx ModuleContext, vndkVersion, fileName string) android.Path {
-	isLlndk := inList(ctx.baseModuleName(), llndkLibraries)
+	isLlndk := inList(ctx.baseModuleName(), llndkLibraries) || inList(ctx.baseModuleName(), ndkMigratedLibs)
 
 	refAbiDumpTextFile := android.PathForVndkRefAbiDump(ctx, vndkVersion, fileName, isLlndk, false)
 	refAbiDumpGzipFile := android.PathForVndkRefAbiDump(ctx, vndkVersion, fileName, isLlndk, true)
diff --git a/cc/makevars.go b/cc/makevars.go
index c3ff4ce..c4ef5f1 100644
--- a/cc/makevars.go
+++ b/cc/makevars.go
@@ -75,6 +75,7 @@
 	ctx.Strict("LLVM_OBJCOPY", "${config.ClangBin}/llvm-objcopy")
 	ctx.Strict("LLVM_STRIP", "${config.ClangBin}/llvm-strip")
 	ctx.Strict("PATH_TO_CLANG_TIDY", "${config.ClangBin}/clang-tidy")
+	ctx.Strict("PATH_TO_CLANG_TIDY_SHELL", "${config.ClangTidyShellPath}")
 	ctx.StrictSorted("CLANG_CONFIG_UNKNOWN_CFLAGS", strings.Join(config.ClangUnknownCflags, " "))
 
 	ctx.Strict("RS_LLVM_PREBUILTS_VERSION", "${config.RSClangVersion}")
@@ -126,6 +127,8 @@
 	ctx.Strict("ADDRESS_SANITIZER_CONFIG_EXTRA_LDFLAGS", strings.Join(asanLdflags, " "))
 	ctx.Strict("ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES", strings.Join(asanLibs, " "))
 
+	ctx.Strict("HWADDRESS_SANITIZER_CONFIG_EXTRA_CFLAGS", strings.Join(hwasanCflags, " "))
+
 	ctx.Strict("CFI_EXTRA_CFLAGS", strings.Join(cfiCflags, " "))
 	ctx.Strict("CFI_EXTRA_LDFLAGS", strings.Join(cfiLdflags, " "))
 
diff --git a/cmd/multiproduct_kati/main.go b/cmd/multiproduct_kati/main.go
index a6bc8d5..813c060 100644
--- a/cmd/multiproduct_kati/main.go
+++ b/cmd/multiproduct_kati/main.go
@@ -307,7 +307,7 @@
 			}}
 			productCtx.Status.AddOutput(terminal.NewStatusOutput(productCtx.Writer, ""))
 
-			productConfig := build.NewConfig(productCtx)
+			productConfig := build.NewConfig(productCtx, flag.Args()...)
 			productConfig.Environment().Set("OUT_DIR", productOutDir)
 			build.FindSources(productCtx, productConfig, finder)
 			productConfig.Lunch(productCtx, product, *buildVariant)
diff --git a/cmd/pom2bp/pom2bp.go b/cmd/pom2bp/pom2bp.go
index a39642f..a66a424 100644
--- a/cmd/pom2bp/pom2bp.go
+++ b/cmd/pom2bp/pom2bp.go
@@ -107,7 +107,7 @@
 type HostModuleNames map[string]bool
 
 func (n HostModuleNames) IsHostModule(groupId string, artifactId string) bool {
-	_, found := n[groupId + ":" + artifactId]
+	_, found := n[groupId+":"+artifactId]
 	return found
 }
 
@@ -293,7 +293,7 @@
 }
 
 var bpTemplate = template.Must(template.New("bp").Parse(`
-{{if .IsAar}}android_library_import{{else}}java_import{{end}} {
+{{if .IsAar}}android_library_import{{else if .IsDeviceModule}}java_import{{else}}java_import_host{{end}} {
     name: "{{.BpName}}-nodeps",
     {{if .IsAar}}aars{{else}}jars{{end}}: ["{{.ArtifactFile}}"],
     sdk_version: "{{.SdkVersion}}",{{if .IsAar}}
@@ -304,7 +304,7 @@
     ],{{end}}
 }
 
-{{if .IsAar}}android_library{{else}}{{if .IsDeviceModule}}java_library_static{{else}}java_library_host{{end}}{{end}} {
+{{if .IsAar}}android_library{{else if .IsDeviceModule}}java_library_static{{else}}java_library_host{{end}} {
     name: "{{.BpName}}",{{if .IsDeviceModule}}
     sdk_version: "{{.SdkVersion}}",{{if .IsAar}}
     min_sdk_version: "{{.MinSdkVersion}}",
diff --git a/java/aar.go b/java/aar.go
index e6a412c..29f5597 100644
--- a/java/aar.go
+++ b/java/aar.go
@@ -156,7 +156,7 @@
 	if !ctx.Config().UnbundledBuild() {
 		sdkDep := decodeSdkDep(ctx, sdkContext)
 		if sdkDep.frameworkResModule != "" {
-			ctx.AddDependency(ctx.Module(), frameworkResTag, sdkDep.frameworkResModule)
+			ctx.AddVariationDependencies(nil, frameworkResTag, sdkDep.frameworkResModule)
 		}
 	}
 }
@@ -375,6 +375,9 @@
 
 	Static_libs []string
 	Libs        []string
+
+	// if set to true, run Jetifier against .aar file. Defaults to false.
+	Jetifier_enabled *bool
 }
 
 type AARImport struct {
@@ -433,12 +436,12 @@
 	if !ctx.Config().UnbundledBuild() {
 		sdkDep := decodeSdkDep(ctx, sdkContext(a))
 		if sdkDep.useModule && sdkDep.frameworkResModule != "" {
-			ctx.AddDependency(ctx.Module(), frameworkResTag, sdkDep.frameworkResModule)
+			ctx.AddVariationDependencies(nil, frameworkResTag, sdkDep.frameworkResModule)
 		}
 	}
 
-	ctx.AddDependency(ctx.Module(), libTag, a.properties.Libs...)
-	ctx.AddDependency(ctx.Module(), staticLibTag, a.properties.Static_libs...)
+	ctx.AddVariationDependencies(nil, libTag, a.properties.Libs...)
+	ctx.AddVariationDependencies(nil, staticLibTag, a.properties.Static_libs...)
 }
 
 // Unzip an AAR into its constituent files and directories.  Any files in Outputs that don't exist in the AAR will be
@@ -456,7 +459,14 @@
 		return
 	}
 
-	aar := android.PathForModuleSrc(ctx, a.properties.Aars[0])
+	aarName := ctx.ModuleName() + ".aar"
+	var aar android.Path
+	aar = android.PathForModuleSrc(ctx, a.properties.Aars[0])
+	if Bool(a.properties.Jetifier_enabled) {
+		inputFile := aar
+		aar = android.PathForModuleOut(ctx, "jetifier", aarName)
+		TransformJetifier(ctx, aar.(android.WritablePath), inputFile)
+	}
 
 	extractedAARDir := android.PathForModuleOut(ctx, "aar")
 	extractedResDir := extractedAARDir.Join(ctx, "res")
diff --git a/java/android_manifest.go b/java/android_manifest.go
index 77b6214..6577475 100644
--- a/java/android_manifest.go
+++ b/java/android_manifest.go
@@ -68,7 +68,7 @@
 			Implicits: staticLibManifests,
 			Output:    mergedManifest,
 			Args: map[string]string{
-				"libs": android.JoinWithPrefix(staticLibManifests.Strings(), "--uses-library "),
+				"libs": android.JoinWithPrefix(staticLibManifests.Strings(), "--libs "),
 			},
 		})
 		manifest = mergedManifest
diff --git a/java/builder.go b/java/builder.go
index ff5de09..c645ee2 100644
--- a/java/builder.go
+++ b/java/builder.go
@@ -66,7 +66,6 @@
 				`${config.GenKotlinBuildFileCmd} $classpath $outDir $out.rsp $srcJarDir/list > $outDir/kotlinc-build.xml &&` +
 				`${config.KotlincCmd} $kotlincFlags ` +
 				`-jvm-target $kotlinJvmTarget -Xbuild-file=$outDir/kotlinc-build.xml && ` +
-				`rm $outDir/kotlinc-build.xml && ` +
 				`${config.SoongZipCmd} -jar -o $out -C $outDir -D $outDir`,
 			CommandDeps: []string{
 				"${config.KotlincCmd}",
@@ -122,6 +121,13 @@
 			CommandDeps: []string{"${config.JavaCmd}", "${config.JarjarCmd}", "$rulesFile"},
 		},
 		"rulesFile")
+
+	jetifier = pctx.AndroidStaticRule("jetifier",
+		blueprint.RuleParams{
+			Command:     "${config.JavaCmd} -jar ${config.JetifierJar} -l error -o $out -i $in",
+			CommandDeps: []string{"${config.JavaCmd}", "${config.JetifierJar}"},
+		},
+	)
 )
 
 func init() {
@@ -372,6 +378,16 @@
 	})
 }
 
+func TransformJetifier(ctx android.ModuleContext, outputFile android.WritablePath,
+	inputFile android.Path) {
+	ctx.Build(pctx, android.BuildParams{
+		Rule:        jetifier,
+		Description: "jetifier",
+		Output:      outputFile,
+		Input:       inputFile,
+	})
+}
+
 type classpath []android.Path
 
 func (x *classpath) FormJavaClassPath(optName string) string {
diff --git a/java/config/config.go b/java/config/config.go
index fa8cb0f..3d27b70 100644
--- a/java/config/config.go
+++ b/java/config/config.go
@@ -27,7 +27,7 @@
 var (
 	pctx = android.NewPackageContext("android/soong/java/config")
 
-	DefaultBootclasspathLibraries = []string{"core-oj", "core-libart"}
+	DefaultBootclasspathLibraries = []string{"core-oj", "core-libart", "core-simple"}
 	DefaultSystemModules          = "core-system-modules"
 	DefaultLibraries              = []string{"ext", "framework", "okhttp"}
 	DefaultLambdaStubsLibrary     = "core-lambda-stubs"
@@ -43,6 +43,7 @@
 		"android.car7",
 		"core-oj",
 		"core-libart",
+		"core-simple",
 	}
 
 	ManifestMergerClasspath = []string{
@@ -122,6 +123,7 @@
 	pctx.HostJavaToolVariable("DoclavaJar", "doclava.jar")
 	pctx.HostJavaToolVariable("MetalavaJar", "metalava.jar")
 	pctx.HostJavaToolVariable("DokkaJar", "dokka.jar")
+	pctx.HostJavaToolVariable("JetifierJar", "jetifier.jar")
 
 	pctx.HostBinToolVariable("SoongJavacWrapper", "soong_javac_wrapper")
 
diff --git a/java/droiddoc.go b/java/droiddoc.go
index 52db705..68d7861 100644
--- a/java/droiddoc.go
+++ b/java/droiddoc.go
@@ -371,24 +371,24 @@
 	if ctx.Device() {
 		sdkDep := decodeSdkDep(ctx, sdkContext(j))
 		if sdkDep.useDefaultLibs {
-			ctx.AddDependency(ctx.Module(), bootClasspathTag, config.DefaultBootclasspathLibraries...)
+			ctx.AddVariationDependencies(nil, bootClasspathTag, config.DefaultBootclasspathLibraries...)
 			if ctx.Config().TargetOpenJDK9() {
-				ctx.AddDependency(ctx.Module(), systemModulesTag, config.DefaultSystemModules)
+				ctx.AddVariationDependencies(nil, systemModulesTag, config.DefaultSystemModules)
 			}
 			if !Bool(j.properties.No_framework_libs) {
-				ctx.AddDependency(ctx.Module(), libTag, config.DefaultLibraries...)
+				ctx.AddVariationDependencies(nil, libTag, config.DefaultLibraries...)
 			}
 		} else if sdkDep.useModule {
 			if ctx.Config().TargetOpenJDK9() {
-				ctx.AddDependency(ctx.Module(), systemModulesTag, sdkDep.systemModules)
+				ctx.AddVariationDependencies(nil, systemModulesTag, sdkDep.systemModules)
 			}
-			ctx.AddDependency(ctx.Module(), bootClasspathTag, sdkDep.modules...)
+			ctx.AddVariationDependencies(nil, bootClasspathTag, sdkDep.modules...)
 		}
 	}
 
-	ctx.AddDependency(ctx.Module(), libTag, j.properties.Libs...)
+	ctx.AddVariationDependencies(nil, libTag, j.properties.Libs...)
 	if j.properties.Srcs_lib != nil {
-		ctx.AddDependency(ctx.Module(), srcsLibTag, *j.properties.Srcs_lib)
+		ctx.AddVariationDependencies(nil, srcsLibTag, *j.properties.Srcs_lib)
 	}
 
 	android.ExtractSourcesDeps(ctx, j.properties.Srcs)
@@ -904,6 +904,7 @@
 	if String(d.properties.Dex_api_filename) != "" {
 		d.dexApiFile = android.PathForModuleOut(ctx, String(d.properties.Dex_api_filename))
 		doclavaFlags += " -dexApi " + d.dexApiFile.String()
+		MetalavaFlags += " --dex-api " + d.dexApiFile.String()
 		*implicitOutputs = append(*implicitOutputs, d.dexApiFile)
 	}
 
@@ -1097,7 +1098,7 @@
 			"apiFileToCheck":        d.apiFile.String(),
 			"removedApiFile":        removedApiFile.String(),
 			"removedApiFileToCheck": d.removedApiFile.String(),
-			"msg": msg,
+			"msg":                   msg,
 		},
 	})
 }
diff --git a/java/java.go b/java/java.go
index 7f82c77..f6c9484 100644
--- a/java/java.go
+++ b/java/java.go
@@ -86,10 +86,6 @@
 	// ext, and framework for device targets)
 	No_framework_libs *bool
 
-	// Use renamed kotlin stdlib (com.android.kotlin.*). This allows kotlin usage without colliding
-	// with app-provided kotlin stdlib.
-	Renamed_kotlin_stdlib *bool
-
 	// list of module-specific flags that will be used for javac compiles
 	Javacflags []string `android:"arch_variant"`
 
@@ -556,41 +552,41 @@
 		if !Bool(j.properties.No_standard_libs) {
 			sdkDep := decodeSdkDep(ctx, sdkContext(j))
 			if sdkDep.useDefaultLibs {
-				ctx.AddDependency(ctx.Module(), bootClasspathTag, config.DefaultBootclasspathLibraries...)
+				ctx.AddVariationDependencies(nil, bootClasspathTag, config.DefaultBootclasspathLibraries...)
 				if ctx.Config().TargetOpenJDK9() {
-					ctx.AddDependency(ctx.Module(), systemModulesTag, config.DefaultSystemModules)
+					ctx.AddVariationDependencies(nil, systemModulesTag, config.DefaultSystemModules)
 				}
 				if !Bool(j.properties.No_framework_libs) {
-					ctx.AddDependency(ctx.Module(), libTag, config.DefaultLibraries...)
+					ctx.AddVariationDependencies(nil, libTag, config.DefaultLibraries...)
 				}
 			} else if sdkDep.useModule {
 				if ctx.Config().TargetOpenJDK9() {
-					ctx.AddDependency(ctx.Module(), systemModulesTag, sdkDep.systemModules)
+					ctx.AddVariationDependencies(nil, systemModulesTag, sdkDep.systemModules)
 				}
-				ctx.AddDependency(ctx.Module(), bootClasspathTag, sdkDep.modules...)
+				ctx.AddVariationDependencies(nil, bootClasspathTag, sdkDep.modules...)
 				if Bool(j.deviceProperties.Optimize.Enabled) {
-					ctx.AddDependency(ctx.Module(), proguardRaiseTag, config.DefaultBootclasspathLibraries...)
-					ctx.AddDependency(ctx.Module(), proguardRaiseTag, config.DefaultLibraries...)
+					ctx.AddVariationDependencies(nil, proguardRaiseTag, config.DefaultBootclasspathLibraries...)
+					ctx.AddVariationDependencies(nil, proguardRaiseTag, config.DefaultLibraries...)
 				}
 			}
 		} else if j.deviceProperties.System_modules == nil {
 			ctx.PropertyErrorf("no_standard_libs",
 				"system_modules is required to be set when no_standard_libs is true, did you mean no_framework_libs?")
 		} else if *j.deviceProperties.System_modules != "none" && ctx.Config().TargetOpenJDK9() {
-			ctx.AddDependency(ctx.Module(), systemModulesTag, *j.deviceProperties.System_modules)
+			ctx.AddVariationDependencies(nil, systemModulesTag, *j.deviceProperties.System_modules)
 		}
 		if ctx.ModuleName() == "framework" {
-			ctx.AddDependency(ctx.Module(), frameworkResTag, "framework-res")
+			ctx.AddVariationDependencies(nil, frameworkResTag, "framework-res")
 		}
 		if ctx.ModuleName() == "android_stubs_current" ||
 			ctx.ModuleName() == "android_system_stubs_current" ||
 			ctx.ModuleName() == "android_test_stubs_current" {
-			ctx.AddDependency(ctx.Module(), frameworkApkTag, "framework-res")
+			ctx.AddVariationDependencies(nil, frameworkApkTag, "framework-res")
 		}
 	}
 
-	ctx.AddDependency(ctx.Module(), libTag, j.properties.Libs...)
-	ctx.AddDependency(ctx.Module(), staticLibTag, j.properties.Static_libs...)
+	ctx.AddVariationDependencies(nil, libTag, j.properties.Libs...)
+	ctx.AddVariationDependencies(nil, staticLibTag, j.properties.Static_libs...)
 	ctx.AddFarVariationDependencies([]blueprint.Variation{
 		{Mutator: "arch", Variation: ctx.Config().BuildOsCommonVariant},
 	}, annoTag, j.properties.Annotation_processors...)
@@ -606,11 +602,11 @@
 	if j.hasSrcExt(".kt") {
 		// TODO(ccross): move this to a mutator pass that can tell if generated sources contain
 		// Kotlin files
-		ctx.AddDependency(ctx.Module(), kotlinStdlibTag, "kotlin-stdlib")
+		ctx.AddVariationDependencies(nil, kotlinStdlibTag, "kotlin-stdlib")
 	}
 
 	if j.shouldInstrumentStatic(ctx) {
-		ctx.AddDependency(ctx.Module(), staticLibTag, "jacocoagent")
+		ctx.AddVariationDependencies(nil, staticLibTag, "jacocoagent")
 	}
 }
 
@@ -1025,8 +1021,6 @@
 		}
 	}
 
-	var stripFiles []string
-
 	var kotlinJars android.Paths
 
 	if srcFiles.HasExt(".kt") {
@@ -1035,7 +1029,6 @@
 		// won't emit any classes for them.
 
 		flags.kotlincFlags = "-no-stdlib"
-
 		if ctx.Device() {
 			flags.kotlincFlags += " -no-jdk"
 		}
@@ -1060,18 +1053,7 @@
 
 		// Jar kotlin classes into the final jar after javac
 		kotlinJars = append(kotlinJars, kotlinJar)
-
-		if Bool(j.properties.Renamed_kotlin_stdlib) {
-			// Remove any kotlin-reflect related files
-			// TODO(pszczepaniak): Support kotlin-reflect
-			stripFiles = append(stripFiles,
-				"**/*.kotlin_module",
-				"**/*.kotlin_builtins")
-		} else {
-			// Only add kotlin-stdlib if not using (on-device) renamed stdlib
-			// (it's expected to be on device bootclasspath)
-			kotlinJars = append(kotlinJars, deps.kotlinStdlib...)
-		}
+		kotlinJars = append(kotlinJars, deps.kotlinStdlib...)
 	}
 
 	jars := append(android.Paths(nil), kotlinJars...)
@@ -1207,21 +1189,10 @@
 	} else {
 		combinedJar := android.PathForModuleOut(ctx, "combined", jarName)
 		TransformJarsToJar(ctx, combinedJar, "for javac", jars, manifest,
-			false, stripFiles, nil)
+			false, nil, nil)
 		outputFile = combinedJar
 	}
 
-	// Use renamed kotlin standard library?
-	if srcFiles.HasExt(".kt") && Bool(j.properties.Renamed_kotlin_stdlib) {
-		jarjarFile := android.PathForModuleOut(ctx, "kotlin-renamed", jarName)
-		TransformJarJar(ctx, jarjarFile, outputFile,
-			android.PathForSource(ctx, "external/kotlinc/jarjar-rules.txt"))
-		outputFile = jarjarFile
-		if ctx.Failed() {
-			return
-		}
-	}
-
 	// jarjar implementation jar if necessary
 	if j.properties.Jarjar_rules != nil {
 		jarjar_rules := android.PathForModuleSrc(ctx, *j.properties.Jarjar_rules)
@@ -1611,6 +1582,9 @@
 
 	// List of directories to remove from the jar file(s)
 	Exclude_dirs []string
+
+	// if set to true, run Jetifier against .jar file. Defaults to false.
+	Jetifier_enabled *bool
 }
 
 type Import struct {
@@ -1645,15 +1619,21 @@
 
 func (j *Import) DepsMutator(ctx android.BottomUpMutatorContext) {
 	android.ExtractSourcesDeps(ctx, j.properties.Jars)
-	ctx.AddDependency(ctx.Module(), libTag, j.properties.Libs...)
+	ctx.AddVariationDependencies(nil, libTag, j.properties.Libs...)
 }
 
 func (j *Import) GenerateAndroidBuildActions(ctx android.ModuleContext) {
 	jars := ctx.ExpandSources(j.properties.Jars, nil)
 
-	outputFile := android.PathForModuleOut(ctx, "classes.jar")
+	jarName := ctx.ModuleName() + ".jar"
+	outputFile := android.PathForModuleOut(ctx, "combined", jarName)
 	TransformJarsToJar(ctx, outputFile, "for prebuilts", jars, android.OptionalPath{},
 		false, j.properties.Exclude_files, j.properties.Exclude_dirs)
+	if Bool(j.properties.Jetifier_enabled) {
+		inputFile := outputFile
+		outputFile = android.PathForModuleOut(ctx, "jetifier", jarName)
+		TransformJetifier(ctx, outputFile, inputFile)
+	}
 	j.combinedClasspathFile = outputFile
 
 	ctx.VisitDirectDeps(func(module android.Module) {
diff --git a/java/java_test.go b/java/java_test.go
index 72341ee..3ace528 100644
--- a/java/java_test.go
+++ b/java/java_test.go
@@ -101,6 +101,7 @@
 		"core-oj",
 		"core-libart",
 		"core-lambda-stubs",
+		"core-simple",
 		"framework",
 		"ext",
 		"okhttp",
@@ -208,8 +209,6 @@
 		"bar-doc/IFoo.aidl":              nil,
 		"bar-doc/known_oj_tags.txt":      nil,
 		"external/doclava/templates-sdk": nil,
-
-		"external/kotlinc/jarjar-rules.txt": nil,
 	}
 
 	for k, v := range fs {
@@ -353,14 +352,14 @@
 }{
 	{
 		name:          "default",
-		bootclasspath: []string{"core-oj", "core-libart"},
+		bootclasspath: []string{"core-oj", "core-libart", "core-simple"},
 		system:        "core-system-modules",
 		classpath:     []string{"ext", "framework", "okhttp"},
 	},
 	{
 		name:          "blank sdk version",
 		properties:    `sdk_version: "",`,
-		bootclasspath: []string{"core-oj", "core-libart"},
+		bootclasspath: []string{"core-oj", "core-libart", "core-simple"},
 		system:        "core-system-modules",
 		classpath:     []string{"ext", "framework", "okhttp"},
 	},
@@ -822,12 +821,6 @@
 			name: "baz",
 			srcs: ["c.java"],
 		}
-
-		java_library {
-			name: "blorg",
-			renamed_kotlin_stdlib: true,
-			srcs: ["b.kt"],
-		}
 		`)
 
 	fooKotlinc := ctx.ModuleForTests("foo", "android_common").Rule("kotlinc")
@@ -870,12 +863,6 @@
 		t.Errorf(`expected %q in bar implicits %v`,
 			bazHeaderJar.Output.String(), barKotlinc.Implicits.Strings())
 	}
-
-	blorgRenamedJar := ctx.ModuleForTests("blorg", "android_common").Output("kotlin-renamed/blorg.jar")
-	if blorgRenamedJar.Implicit.String() != "external/kotlinc/jarjar-rules.txt" {
-		t.Errorf(`expected external/kotlinc/jarjar-rules.txt in blorg implicit %q`,
-			blorgRenamedJar.Implicit.String())
-	}
 }
 
 func TestTurbine(t *testing.T) {
diff --git a/java/proto.go b/java/proto.go
index 58b039e..8028039 100644
--- a/java/proto.go
+++ b/java/proto.go
@@ -73,14 +73,14 @@
 func protoDeps(ctx android.BottomUpMutatorContext, p *android.ProtoProperties) {
 	switch String(p.Proto.Type) {
 	case "micro":
-		ctx.AddDependency(ctx.Module(), staticLibTag, "libprotobuf-java-micro")
+		ctx.AddVariationDependencies(nil, staticLibTag, "libprotobuf-java-micro")
 	case "nano":
-		ctx.AddDependency(ctx.Module(), staticLibTag, "libprotobuf-java-nano")
+		ctx.AddVariationDependencies(nil, staticLibTag, "libprotobuf-java-nano")
 	case "lite", "":
-		ctx.AddDependency(ctx.Module(), staticLibTag, "libprotobuf-java-lite")
+		ctx.AddVariationDependencies(nil, staticLibTag, "libprotobuf-java-lite")
 	case "full":
 		if ctx.Host() {
-			ctx.AddDependency(ctx.Module(), staticLibTag, "libprotobuf-java-full")
+			ctx.AddVariationDependencies(nil, staticLibTag, "libprotobuf-java-full")
 		} else {
 			ctx.PropertyErrorf("proto.type", "full java protos only supported on the host")
 		}
diff --git a/java/sdk_library.go b/java/sdk_library.go
index 525652a..d588801 100644
--- a/java/sdk_library.go
+++ b/java/sdk_library.go
@@ -156,14 +156,14 @@
 
 func (module *sdkLibrary) DepsMutator(ctx android.BottomUpMutatorContext) {
 	// Add dependencies to the stubs library
-	ctx.AddDependency(ctx.Module(), publicApiStubsTag, module.stubsName(apiScopePublic))
-	ctx.AddDependency(ctx.Module(), systemApiStubsTag, module.stubsName(apiScopeSystem))
-	ctx.AddDependency(ctx.Module(), testApiStubsTag, module.stubsName(apiScopeTest))
-	ctx.AddDependency(ctx.Module(), implLibTag, module.implName())
+	ctx.AddVariationDependencies(nil, publicApiStubsTag, module.stubsName(apiScopePublic))
+	ctx.AddVariationDependencies(nil, systemApiStubsTag, module.stubsName(apiScopeSystem))
+	ctx.AddVariationDependencies(nil, testApiStubsTag, module.stubsName(apiScopeTest))
+	ctx.AddVariationDependencies(nil, implLibTag, module.implName())
 
-	ctx.AddDependency(ctx.Module(), publicApiFileTag, module.docsName(apiScopePublic))
-	ctx.AddDependency(ctx.Module(), systemApiFileTag, module.docsName(apiScopeSystem))
-	ctx.AddDependency(ctx.Module(), testApiFileTag, module.docsName(apiScopeTest))
+	ctx.AddVariationDependencies(nil, publicApiFileTag, module.docsName(apiScopePublic))
+	ctx.AddVariationDependencies(nil, systemApiFileTag, module.docsName(apiScopeSystem))
+	ctx.AddVariationDependencies(nil, testApiFileTag, module.docsName(apiScopeTest))
 }
 
 func (module *sdkLibrary) GenerateAndroidBuildActions(ctx android.ModuleContext) {
diff --git a/java/system_modules.go b/java/system_modules.go
index d98e0ab..9ee0307 100644
--- a/java/system_modules.go
+++ b/java/system_modules.go
@@ -123,7 +123,7 @@
 }
 
 func (system *SystemModules) DepsMutator(ctx android.BottomUpMutatorContext) {
-	ctx.AddDependency(ctx.Module(), libTag, system.properties.Libs...)
+	ctx.AddVariationDependencies(nil, libTag, system.properties.Libs...)
 }
 
 func (system *SystemModules) AndroidMk() android.AndroidMkData {
diff --git a/scripts/build-ndk-prebuilts.sh b/scripts/build-ndk-prebuilts.sh
index e3552a0..7f6e2c9 100755
--- a/scripts/build-ndk-prebuilts.sh
+++ b/scripts/build-ndk-prebuilts.sh
@@ -62,7 +62,6 @@
         "armeabi-v7a"
     ],
     "HostArch": "x86_64",
-    "HostSecondaryArch": "x86",
     "Malloc_not_svelte": false,
     "Safestack": false
 }
diff --git a/ui/build/cleanbuild.go b/ui/build/cleanbuild.go
index a076b66..4dee638 100644
--- a/ui/build/cleanbuild.go
+++ b/ui/build/cleanbuild.go
@@ -102,6 +102,7 @@
 		productOut("skin"),
 		productOut("obj/NOTICE_FILES"),
 		productOut("obj/PACKAGING"),
+		productOut("ramdisk"),
 		productOut("recovery"),
 		productOut("root"),
 		productOut("system"),
diff --git a/ui/build/config.go b/ui/build/config.go
index c171a67..2605f5b 100644
--- a/ui/build/config.go
+++ b/ui/build/config.go
@@ -50,8 +50,10 @@
 	targetDevice    string
 	targetDeviceDir string
 
-	pdkBuild       bool
-	brokenDupRules bool
+	pdkBuild bool
+
+	brokenDupRules     bool
+	brokenPhonyTargets bool
 
 	pathReplaced bool
 }
@@ -577,6 +579,14 @@
 	return c.brokenDupRules
 }
 
+func (c *configImpl) SetBuildBrokenPhonyTargets(val bool) {
+	c.brokenPhonyTargets = val
+}
+
+func (c *configImpl) BuildBrokenPhonyTargets() bool {
+	return c.brokenPhonyTargets
+}
+
 func (c *configImpl) SetTargetDeviceDir(dir string) {
 	c.targetDeviceDir = dir
 }
diff --git a/ui/build/dumpvars.go b/ui/build/dumpvars.go
index 8f9d8f2..fadf6c6 100644
--- a/ui/build/dumpvars.go
+++ b/ui/build/dumpvars.go
@@ -165,10 +165,12 @@
 		// Whether --werror_overriding_commands will work
 		"BUILD_BROKEN_DUP_RULES",
 
+		// Used to turn on --werror_ options in Kati
+		"BUILD_BROKEN_PHONY_TARGETS",
+
 		// Not used, but useful to be in the soong.log
 		"BUILD_BROKEN_ANDROIDMK_EXPORTS",
 		"BUILD_BROKEN_DUP_COPY_HEADERS",
-		"BUILD_BROKEN_PHONY_TARGETS",
 	}, exportEnvVars...), BannerVars...)
 
 	make_vars, err := dumpMakeVars(ctx, config, config.Arguments(), allVars, true)
@@ -196,4 +198,5 @@
 
 	config.SetPdkBuild(make_vars["TARGET_BUILD_PDK"] == "true")
 	config.SetBuildBrokenDupRules(make_vars["BUILD_BROKEN_DUP_RULES"] == "true")
+	config.SetBuildBrokenPhonyTargets(make_vars["BUILD_BROKEN_PHONY_TARGETS"] != "false")
 }
diff --git a/ui/build/kati.go b/ui/build/kati.go
index de8dbf4..b54872c 100644
--- a/ui/build/kati.go
+++ b/ui/build/kati.go
@@ -93,6 +93,10 @@
 		args = append(args, "--werror_overriding_commands")
 	}
 
+	if !config.BuildBrokenPhonyTargets() {
+		args = append(args, "--werror_real_to_phony", "--werror_phony_looks_real")
+	}
+
 	if !config.Environment().IsFalse("KATI_EMULATE_FIND") {
 		args = append(args, "--use_find_emulator")
 	}
diff --git a/ui/build/paths/config.go b/ui/build/paths/config.go
index aeefcf2..b7128d7 100644
--- a/ui/build/paths/config.go
+++ b/ui/build/paths/config.go
@@ -40,12 +40,13 @@
 }
 
 // The configuration used if the tool is not listed in the config below.
-// Currently this will create the symlink, but log a warning. In the future,
-// I expect this to move closer to Forbidden.
+// Currently this will create the symlink, but log and error when it's used. In
+// the future, I expect the symlink to be removed, and this will be equivalent
+// to Forbidden.
 var Missing = PathConfig{
 	Symlink: true,
 	Log:     true,
-	Error:   false,
+	Error:   true,
 }
 
 func GetConfig(name string) PathConfig {
@@ -77,6 +78,7 @@
 	"env":       Allowed,
 	"expr":      Allowed,
 	"find":      Allowed,
+	"fuser":     Allowed,
 	"getconf":   Allowed,
 	"getopt":    Allowed,
 	"git":       Allowed,
@@ -98,6 +100,7 @@
 	"mkdir":     Allowed,
 	"mktemp":    Allowed,
 	"mv":        Allowed,
+	"od":        Allowed,
 	"openssl":   Allowed,
 	"paste":     Allowed,
 	"patch":     Allowed,
@@ -128,11 +131,13 @@
 	"sum":       Allowed,
 	"tar":       Allowed,
 	"tail":      Allowed,
+	"todos":     Allowed,
 	"touch":     Allowed,
 	"tr":        Allowed,
 	"true":      Allowed,
 	"uname":     Allowed,
 	"uniq":      Allowed,
+	"unix2dos":  Allowed,
 	"unzip":     Allowed,
 	"wc":        Allowed,
 	"which":     Allowed,