Merge "Revert "CFI compatibility with static executables and nested archives""
diff --git a/core/config.mk b/core/config.mk
index dc3958a..5805405 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -61,18 +61,6 @@
 # If a rule fails, delete $@.
 .DELETE_ON_ERROR:
 
-# Check for broken versions of make.
-ifndef KATI
-ifneq (1,$(strip $(shell expr $(MAKE_VERSION) \>= 3.81)))
-$(warning ********************************************************************************)
-$(warning *  You are using version $(MAKE_VERSION) of make.)
-$(warning *  Android can only be built by versions 3.81 and higher.)
-$(warning *  see https://source.android.com/source/download.html)
-$(warning ********************************************************************************)
-$(error stopping)
-endif
-endif
-
 # Used to force goals to build.  Only use for conditionally defined goals.
 .PHONY: FORCE
 FORCE:
diff --git a/core/product_config.mk b/core/product_config.mk
index d7881df..deb68ba 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -151,6 +151,13 @@
 endif # unbundled_goals
 endif
 
+# Now that we've parsed APP-* and PRODUCT-*, mark these as readonly
+TARGET_BUILD_APPS ?=
+.KATI_READONLY := \
+  TARGET_PRODUCT \
+  TARGET_BUILD_VARIANT \
+  TARGET_BUILD_APPS
+
 # Default to building dalvikvm on hosts that support it...
 ifeq ($(HOST_OS),linux)
 # ... or if the if the option is already set
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index a9e1606..165976c 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -46,9 +46,9 @@
       Similar to --full_radio. When generating an incremental OTA, always
       include a full copy of bootloader image.
 
-  -v  (--verify)
-      Remount and verify the checksums of the files written to the
-      system and vendor (if used) partitions.  Incremental builds only.
+  --verify
+      Remount and verify the checksums of the files written to the system and
+      vendor (if used) partitions. Non-A/B incremental OTAs only.
 
   -o  (--oem_settings)  <main_file[,additional_files...]>
       Comma seperated list of files used to specify the expected OEM-specific
diff --git a/tools/signapk/src/com/android/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
index 3b00599..fdf6283 100644
--- a/tools/signapk/src/com/android/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -1082,14 +1082,15 @@
                     ByteBuffer[] outputChunks = new ByteBuffer[] {v1SignedApk};
 
                     ZipSections zipSections = findMainZipSections(v1SignedApk);
-                    ApkSignerEngine.OutputApkSigningBlockRequest addV2SignatureRequest =
-                            apkSigner.outputZipSections(
+                    ApkSignerEngine.OutputApkSigningBlockRequest2 addV2SignatureRequest =
+                            apkSigner.outputZipSections2(
                                     DataSources.asDataSource(zipSections.beforeCentralDir),
                                     DataSources.asDataSource(zipSections.centralDir),
                                     DataSources.asDataSource(zipSections.eocd));
                     if (addV2SignatureRequest != null) {
                         // Need to insert the returned APK Signing Block before ZIP Central
                         // Directory.
+                        int padding = addV2SignatureRequest.getPaddingSizeBeforeApkSigningBlock();
                         byte[] apkSigningBlock = addV2SignatureRequest.getApkSigningBlock();
                         // Because the APK Signing Block is inserted before the Central Directory,
                         // we need to adjust accordingly the offset of Central Directory inside the
@@ -1100,10 +1101,12 @@
                         modifiedEocd.order(ByteOrder.LITTLE_ENDIAN);
                         ApkUtils.setZipEocdCentralDirectoryOffset(
                                 modifiedEocd,
-                                zipSections.beforeCentralDir.remaining() + apkSigningBlock.length);
+                                zipSections.beforeCentralDir.remaining() + padding +
+                                apkSigningBlock.length);
                         outputChunks =
                                 new ByteBuffer[] {
                                         zipSections.beforeCentralDir,
+                                        ByteBuffer.allocate(padding),
                                         ByteBuffer.wrap(apkSigningBlock),
                                         zipSections.centralDir,
                                         modifiedEocd};