diff --git a/Android.bp b/Android.bp
index bd2d0b0..52de770 100644
--- a/Android.bp
+++ b/Android.bp
@@ -12,6 +12,40 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// *** THIS PACKAGE HAS SPECIAL LICENSING CONDITIONS.  PLEASE
+//     CONSULT THE OWNERS AND opensource-licensing@google.com BEFORE
+//     DEPENDING ON IT IN YOUR PROJECT. ***
+package {
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
+// Added automatically by a large-scale-change that took the approach of
+// 'apply every license found to every target'. While this makes sure we respect
+// every license restriction, it may not be entirely correct.
+//
+// e.g. GPL in an MIT project might only apply to the contrib/ directory.
+//
+// Please consider splitting the single license below into multiple licenses,
+// taking care not to lose any license_kind information, and overriding the
+// default license using the 'licenses: [...]' property on targets as needed.
+//
+// For unused files, consider creating a 'fileGroup' with "//visibility:private"
+// to attach the license to, and including a comment whether the files may be
+// used in the current project.
+// See: http://go/android-license-faq
+license {
+    name: "bootable_recovery_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-Apache-2.0",
+        "SPDX-license-identifier-MIT",
+        "SPDX-license-identifier-OFL", // by exception only
+    ],
+    license_text: [
+        "NOTICE",
+    ],
+}
+
 cc_defaults {
     name: "recovery_defaults",
 
diff --git a/Android.mk b/Android.mk
index 5816749..96af417 100644
--- a/Android.mk
+++ b/Android.mk
@@ -28,6 +28,9 @@
 include $(CLEAR_VARS)
 
 LOCAL_MODULE := librecovery_ui_ext
+LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 SPDX-license-identifier-MIT SPDX-license-identifier-OFL
+LOCAL_LICENSE_CONDITIONS := by_exception_only notice
+LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
 
 # LOCAL_MODULE_PATH for shared libraries is unsupported in multiarch builds.
 LOCAL_MULTILIB := first
@@ -54,6 +57,9 @@
 include $(CLEAR_VARS)
 
 LOCAL_MODULE := recovery_deps
+LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 SPDX-license-identifier-MIT SPDX-license-identifier-OFL
+LOCAL_LICENSE_CONDITIONS := by_exception_only notice
+LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
 
 ifeq ($(TARGET_USERIMAGES_USE_F2FS),true)
 LOCAL_REQUIRED_MODULES += \
diff --git a/applypatch/Android.bp b/applypatch/Android.bp
index a6662c4..0d6d23b 100644
--- a/applypatch/Android.bp
+++ b/applypatch/Android.bp
@@ -12,6 +12,23 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    default_applicable_licenses: ["bootable_recovery_applypatch_license"],
+}
+
+// Added automatically by a large-scale-change
+// See: http://go/android-license-faq
+license {
+    name: "bootable_recovery_applypatch_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-Apache-2.0",
+    ],
+    license_text: [
+        "NOTICE",
+    ],
+}
+
 cc_defaults {
     name: "applypatch_defaults",
 
diff --git a/bootloader_message/Android.bp b/bootloader_message/Android.bp
index 6443a07..778fdb9 100644
--- a/bootloader_message/Android.bp
+++ b/bootloader_message/Android.bp
@@ -14,6 +14,15 @@
 // limitations under the License.
 //
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_defaults {
     name: "libbootloader_message_defaults",
     srcs: ["bootloader_message.cpp"],
diff --git a/edify/Android.bp b/edify/Android.bp
index 0ab53d6..62ff911 100644
--- a/edify/Android.bp
+++ b/edify/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_library_static {
     name: "libedify",
 
diff --git a/etc/init.rc b/etc/init.rc
index 3ec45db..5cacb8b 100644
--- a/etc/init.rc
+++ b/etc/init.rc
@@ -24,9 +24,6 @@
     symlink /system/bin /bin
     symlink /system/etc /etc
 
-    mount cgroup none /acct cpuacct
-    mkdir /acct/uid
-
     mkdir /sdcard
     mkdir /system
     mkdir /data
diff --git a/fuse_sideload/Android.bp b/fuse_sideload/Android.bp
index 9bf19eb..4eb21dc 100644
--- a/fuse_sideload/Android.bp
+++ b/fuse_sideload/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_library {
     name: "libfusesideload",
     recovery_available: true,
diff --git a/install/Android.bp b/install/Android.bp
index bed3bc5..e239ddc 100644
--- a/install/Android.bp
+++ b/install/Android.bp
@@ -12,11 +12,21 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_defaults {
     name: "libinstall_defaults",
 
     defaults: [
         "recovery_defaults",
+        "libspl_check_defaults",
     ],
 
     shared_libs: [
@@ -40,12 +50,51 @@
         "librecovery_utils",
         "libotautil",
         "libsnapshot_nobinder",
+        "ota_metadata_proto_cc",
 
         // external dependencies
         "libvintf",
     ],
 }
 
+cc_test_host {
+    name: "libinstall_host_unittests",
+    defaults: [
+        "libspl_check_defaults"
+    ],
+    srcs: [
+        "spl_check_unittests.cpp",
+    ],
+    static_libs: [
+        "libspl_check",
+    ],
+}
+
+cc_defaults {
+    name: "libspl_check_defaults",
+    static_libs: [
+        "libbase",
+        "ota_metadata_proto_cc",
+        "liblog",
+        "libziparchive",
+        "libz",
+        "libprotobuf-cpp-lite",
+    ],
+}
+
+cc_library_static {
+    name: "libspl_check",
+    recovery_available: true,
+    host_supported: true,
+    defaults: [
+        "libspl_check_defaults",
+    ],
+    srcs: ["spl_check.cpp"],
+    export_include_dirs: [
+        "include",
+    ],
+}
+
 cc_library_static {
     name: "libinstall",
     recovery_available: true,
@@ -64,6 +113,7 @@
         "verifier.cpp",
         "wipe_data.cpp",
         "wipe_device.cpp",
+        "spl_check.cpp",
     ],
 
     header_libs: [
diff --git a/install/include/install/spl_check.h b/install/include/install/spl_check.h
new file mode 100644
index 0000000..e0bfc62
--- /dev/null
+++ b/install/include/install/spl_check.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string_view>
+
+#include <android-base/logging.h>
+#include <ota_metadata.pb.h>
+#include <ziparchive/zip_archive.h>
+
+bool ViolatesSPLDowngrade(const build::tools::releasetools::OtaMetadata& metadata,
+                          std::string_view current_spl);
+
+bool ViolatesSPLDowngrade(ZipArchiveHandle zip, std::string_view current_spl);
diff --git a/install/install.cpp b/install/install.cpp
index 1b220cb..6e74f80 100644
--- a/install/install.cpp
+++ b/install/install.cpp
@@ -47,6 +47,7 @@
 #include <android-base/unique_fd.h>
 
 #include "install/package.h"
+#include "install/spl_check.h"
 #include "install/verifier.h"
 #include "install/wipe_data.h"
 #include "otautil/error_code.h"
@@ -348,6 +349,12 @@
       android::base::GetBoolProperty("ro.virtual_ab.allow_non_ab", false);
   bool device_only_supports_ab = device_supports_ab && !ab_device_supports_nonab;
 
+  const auto current_spl = android::base::GetProperty("ro.build.version.security_patch", "");
+  if (ViolatesSPLDowngrade(zip, current_spl)) {
+    LOG(ERROR) << "Denying OTA because it's SPL downgrade";
+    return INSTALL_ERROR;
+  }
+
   if (package_is_ab) {
     CHECK(package->GetType() == PackageType::kFile);
   }
diff --git a/install/spl_check.cpp b/install/spl_check.cpp
new file mode 100644
index 0000000..c26ab82
--- /dev/null
+++ b/install/spl_check.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "install/spl_check.h"
+
+bool ViolatesSPLDowngrade(const build::tools::releasetools::OtaMetadata& metadata,
+                          std::string_view current_spl) {
+  const auto& post_spl = metadata.postcondition().security_patch_level();
+  if (current_spl.empty()) {
+    LOG(WARNING) << "Failed to get device's current security patch level. Target SPL is "
+                 << post_spl << " permitting OTA install";
+    return false;
+  }
+  // SPL(security patch level) is expected to be in format yyyy-mm-dd, e.g.  2018-05-29. Given this
+  // specific format, comparing two SPL can be done by just regular string comparison. If the format
+  // must lay out year/month/date in the exact order, and must properly prepend dates with 0(for
+  // example, 05 for May). Otherwise this comparison doesn't work. We don't expect SPL date formats
+  // to change, leave this as is.
+  if (post_spl < current_spl) {
+    LOG(ERROR) << "Current SPL: " << current_spl << " Target SPL: " << post_spl
+               << " this is considered a downgrade";
+    if (metadata.spl_downgrade() || metadata.downgrade()) {
+      LOG(WARNING)
+          << "SPL downgrade detected, but OTA package explicitly permitts this(OtaMetadata has "
+             "spl_downgrade / downgrade bit set).Permitting update anyway.Installing a SPL "
+             "downgrade OTA can cause /data fail to decrypt and device fails to boot.";
+      return false;
+    }
+    return true;
+  } else {
+    LOG(INFO) << "old spl: " << current_spl << " new spl: " << post_spl << " CHECK passes";
+  }
+  return false;
+}
+
+bool ViolatesSPLDowngrade(ZipArchiveHandle zip, std::string_view current_spl) {
+  static constexpr auto&& OTA_OTA_METADATA = "META-INF/com/android/metadata.pb";
+  ZipEntry64 metadata_entry;
+  if (FindEntry(zip, OTA_OTA_METADATA, &metadata_entry) != 0) {
+    LOG(WARNING) << "Failed to find " << OTA_OTA_METADATA
+                 << " treating this as non-spl-downgrade, permit OTA install. If device bricks "
+                    "after installing, check kernel log to see if /data failed to decrypt";
+    return false;
+  }
+  const auto metadata_entry_length = metadata_entry.uncompressed_length;
+  if (metadata_entry_length > std::numeric_limits<size_t>::max()) {
+    LOG(ERROR) << "Failed to extract " << OTA_OTA_METADATA
+               << " because's uncompressed size exceeds size of address space. "
+               << metadata_entry_length;
+    return false;
+  }
+  std::vector<uint8_t> ota_metadata(metadata_entry_length);
+  int32_t err = ExtractToMemory(zip, &metadata_entry, ota_metadata.data(), metadata_entry_length);
+  if (err != 0) {
+    LOG(ERROR) << "Failed to extract " << OTA_OTA_METADATA << ": " << ErrorCodeString(err);
+    return false;
+  }
+  using build::tools::releasetools::OtaMetadata;
+  OtaMetadata metadata;
+  if (!metadata.ParseFromArray(ota_metadata.data(), ota_metadata.size())) {
+    LOG(ERROR) << "Failed to parse ota_medata";
+    return false;
+  }
+  return ViolatesSPLDowngrade(metadata, current_spl);
+}
diff --git a/install/spl_check_unittests.cpp b/install/spl_check_unittests.cpp
new file mode 100644
index 0000000..709b69c
--- /dev/null
+++ b/install/spl_check_unittests.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "install/spl_check.h"
+#include "ota_metadata.pb.h"
+
+using build::tools::releasetools::OtaMetadata;
+class SplCheckUnittest : public ::testing::Test {
+ public:
+  OtaMetadata metadata;
+};
+
+TEST_F(SplCheckUnittest, OlderSPL) {
+  metadata.set_spl_downgrade(false);
+  metadata.mutable_postcondition()->set_security_patch_level("2021-04-25");
+  ASSERT_TRUE(ViolatesSPLDowngrade(metadata, "2021-05-01"));
+}
+
+TEST_F(SplCheckUnittest, NewerSPL) {
+  metadata.set_spl_downgrade(false);
+  metadata.mutable_postcondition()->set_security_patch_level("2021-06-01");
+  ASSERT_FALSE(ViolatesSPLDowngrade(metadata, "2021-05-05"));
+}
+
+TEST_F(SplCheckUnittest, OlderSPLPermit) {
+  // If spl_downgrade is set to true, OTA should be permitted
+  metadata.set_spl_downgrade(true);
+  metadata.mutable_postcondition()->set_security_patch_level("2021-04-11");
+  ASSERT_FALSE(ViolatesSPLDowngrade(metadata, "2021-05-11"));
+}
\ No newline at end of file
diff --git a/install/wipe_data.cpp b/install/wipe_data.cpp
index 2872085..4eecf72 100644
--- a/install/wipe_data.cpp
+++ b/install/wipe_data.cpp
@@ -41,9 +41,6 @@
   bool is_cache = (strcmp(volume, CACHE_ROOT) == 0);
   bool is_data = (strcmp(volume, DATA_ROOT) == 0);
 
-  ui->SetBackground(RecoveryUI::ERASING);
-  ui->SetProgressType(RecoveryUI::INDETERMINATE);
-
   std::vector<saved_log_file> log_files;
   if (is_cache) {
     // If we're reformatting /cache, we load any past logs (i.e. "/cache/recovery/last_*") and the
@@ -97,6 +94,9 @@
   }
 
   ui->Print("\n-- Wiping cache...\n");
+  ui->SetBackground(RecoveryUI::ERASING);
+  ui->SetProgressType(RecoveryUI::INDETERMINATE);
+
   bool success = EraseVolume("/cache", ui, false);
   ui->Print("Cache wipe %s.\n", success ? "complete" : "failed");
   return success;
@@ -105,6 +105,8 @@
 bool WipeData(Device* device, bool convert_fbe) {
   RecoveryUI* ui = device->GetUI();
   ui->Print("\n-- Wiping data...\n");
+  ui->SetBackground(RecoveryUI::ERASING);
+  ui->SetProgressType(RecoveryUI::INDETERMINATE);
 
   if (!FinishPendingSnapshotMerges(device)) {
     ui->Print("Unable to check update status or complete merge, cannot wipe partitions.\n");
diff --git a/minadbd/Android.bp b/minadbd/Android.bp
index fb51a79..2bcfece 100644
--- a/minadbd/Android.bp
+++ b/minadbd/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_defaults {
     name: "minadbd_defaults",
 
diff --git a/minui/Android.bp b/minui/Android.bp
index 8258816..f68f6c8 100644
--- a/minui/Android.bp
+++ b/minui/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_library {
     name: "libminui",
     recovery_available: true,
diff --git a/minui/graphics_drm.cpp b/minui/graphics_drm.cpp
index 95759e3..9d31ff7 100644
--- a/minui/graphics_drm.cpp
+++ b/minui/graphics_drm.cpp
@@ -105,6 +105,8 @@
     perror("Failed to DRM_IOCTL_MODE_CREATE_DUMB");
     return nullptr;
   }
+  printf("Allocating buffer with resolution %d x %d pitch: %d bpp: %d, size: %llu\n", width, height,
+         create_dumb.pitch, create_dumb.bpp, create_dumb.size);
 
   // Cannot use std::make_unique to access non-public ctor.
   auto surface = std::unique_ptr<GRSurfaceDrm>(new GRSurfaceDrm(
@@ -128,13 +130,14 @@
     return nullptr;
   }
 
-  auto mmapped = mmap(nullptr, surface->height * surface->row_bytes, PROT_READ | PROT_WRITE,
-                      MAP_SHARED, drm_fd, map_dumb.offset);
+  auto mmapped =
+      mmap(nullptr, create_dumb.size, PROT_READ | PROT_WRITE, MAP_SHARED, drm_fd, map_dumb.offset);
   if (mmapped == MAP_FAILED) {
     perror("Failed to mmap()");
     return nullptr;
   }
   surface->mmapped_buffer_ = static_cast<uint8_t*>(mmapped);
+  printf("Framebuffer of size %llu allocated @ %p\n", create_dumb.size, surface->mmapped_buffer_);
   return surface;
 }
 
@@ -260,9 +263,16 @@
   /* If we still didn't find a connector, give up and return. */
   if (!main_monitor_connector) return nullptr;
 
+  for (int modes = 0; modes < main_monitor_connector->count_modes; modes++) {
+    printf("Display Mode %d resolution: %d x %d @ %d FPS\n", modes,
+           main_monitor_connector->modes[modes].hdisplay,
+           main_monitor_connector->modes[modes].vdisplay,
+           main_monitor_connector->modes[modes].vrefresh);
+  }
   *mode_index = 0;
   for (int modes = 0; modes < main_monitor_connector->count_modes; modes++) {
     if (main_monitor_connector->modes[modes].type & DRM_MODE_TYPE_PREFERRED) {
+      printf("Choosing display mode #%d\n", modes);
       *mode_index = modes;
       break;
     }
diff --git a/otautil/Android.bp b/otautil/Android.bp
index 3b3f9cb..557b8a3 100644
--- a/otautil/Android.bp
+++ b/otautil/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_library_static {
     name: "libotautil",
 
diff --git a/recovery_ui/Android.bp b/recovery_ui/Android.bp
index c9616ec..f64b0d1 100644
--- a/recovery_ui/Android.bp
+++ b/recovery_ui/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_library {
     name: "librecovery_ui",
     recovery_available: true,
diff --git a/recovery_utils/Android.bp b/recovery_utils/Android.bp
index bf79a2e..e0e9ec0 100644
--- a/recovery_utils/Android.bp
+++ b/recovery_utils/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_defaults {
     name: "librecovery_utils_defaults",
 
diff --git a/tests/Android.bp b/tests/Android.bp
index d2179e4..5ef4d58 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_defaults {
     name: "recovery_test_defaults",
 
@@ -139,9 +148,11 @@
         "libupdater_core",
         "libupdate_verifier",
 
-        "libgtest_prod",
         "libprotobuf-cpp-lite",
     ],
+    header_libs: [
+        "libgtest_prod_headers",
+    ],
 
     data: [
         "testdata/*",
diff --git a/tools/image_generator/Android.bp b/tools/image_generator/Android.bp
index 8300040..c9748fa 100644
--- a/tools/image_generator/Android.bp
+++ b/tools/image_generator/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 java_library_host {
     name: "RecoveryImageGenerator",
 
diff --git a/tools/recovery_l10n/Android.bp b/tools/recovery_l10n/Android.bp
index d0a6d4b..ac08e1a 100644
--- a/tools/recovery_l10n/Android.bp
+++ b/tools/recovery_l10n/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 android_app {
     name: "RecoveryLocalizer",
 
diff --git a/tools/recovery_l10n/res/values-az/strings.xml b/tools/recovery_l10n/res/values-az/strings.xml
index 35194c4..d624e63 100644
--- a/tools/recovery_l10n/res/values-az/strings.xml
+++ b/tools/recovery_l10n/res/values-az/strings.xml
@@ -5,7 +5,7 @@
     <string name="recovery_erasing" msgid="7334826894904037088">"Silinir"</string>
     <string name="recovery_no_command" msgid="4465476568623024327">"Əmr yoxdur"</string>
     <string name="recovery_error" msgid="5748178989622716736">"Xəta!"</string>
-    <string name="recovery_installing_security" msgid="9184031299717114342">"Təhlükəsizlik güncəlləməsi yüklənir"</string>
+    <string name="recovery_installing_security" msgid="9184031299717114342">"Güvənlik güncəllənməsi quraşdırılır"</string>
     <string name="recovery_wipe_data_menu_header" msgid="550255032058254478">"Android sistemi yüklənmir. Datanız zədələnə bilər. Bu mesajı yenə qəbul etsəniz, data zavod sıfırlamasını həyata keçirməli və bu cihazda saxlanmış istifadəçi datasının hamısını silməlisiniz."</string>
     <string name="recovery_try_again" msgid="7168248750158873496">"Yenidən cəhd edin"</string>
     <string name="recovery_factory_data_reset" msgid="7321351565602894783">"Data zavod sıfırlaması"</string>
diff --git a/tools/recovery_l10n/res/values-fa/strings.xml b/tools/recovery_l10n/res/values-fa/strings.xml
index 1c1be9a..7e1dbe7 100644
--- a/tools/recovery_l10n/res/values-fa/strings.xml
+++ b/tools/recovery_l10n/res/values-fa/strings.xml
@@ -9,6 +9,6 @@
     <string name="recovery_wipe_data_menu_header" msgid="550255032058254478">"‏نمی‌توان سیستم Android را بارگیری کرد. ممکن است داده‌های شما خراب باشند. اگر همچنان این پیام را دریافت می‌کنید، شاید لازم باشد بازنشانی داده‌های کارخانه‌ای انجام دهید و همه داده‌های کاربر را که در این دستگاه ذخیره شده است پاک کنید."</string>
     <string name="recovery_try_again" msgid="7168248750158873496">"تلاش مجدد"</string>
     <string name="recovery_factory_data_reset" msgid="7321351565602894783">"بازنشانی داده‌های کارخانه"</string>
-    <string name="recovery_wipe_data_confirmation" msgid="5439823343348043954">"همه داده‌های کاربر پاک شود؟\n\n این کار قابل‌واگرد نیست!"</string>
+    <string name="recovery_wipe_data_confirmation" msgid="5439823343348043954">"همه داده‌های کاربر محو شود؟\n\n این کار واگردشدنی نیست!"</string>
     <string name="recovery_cancel_wipe_data" msgid="66987687653647384">"لغو"</string>
 </resources>
diff --git a/tools/recovery_l10n/res/values-fi/strings.xml b/tools/recovery_l10n/res/values-fi/strings.xml
index fddaf14..e825783 100644
--- a/tools/recovery_l10n/res/values-fi/strings.xml
+++ b/tools/recovery_l10n/res/values-fi/strings.xml
@@ -10,5 +10,5 @@
     <string name="recovery_try_again" msgid="7168248750158873496">"Yritä uudelleen"</string>
     <string name="recovery_factory_data_reset" msgid="7321351565602894783">"Tehdasasetuksien palauttaminen"</string>
     <string name="recovery_wipe_data_confirmation" msgid="5439823343348043954">"Poistetaanko kaikki käyttäjätiedot?\n\nTÄTÄ EI VOI PERUA!"</string>
-    <string name="recovery_cancel_wipe_data" msgid="66987687653647384">"Peruuta"</string>
+    <string name="recovery_cancel_wipe_data" msgid="66987687653647384">"Peru"</string>
 </resources>
diff --git a/tools/recovery_l10n/res/values-iw/strings.xml b/tools/recovery_l10n/res/values-iw/strings.xml
index 8ca3bdf..0b81d05 100644
--- a/tools/recovery_l10n/res/values-iw/strings.xml
+++ b/tools/recovery_l10n/res/values-iw/strings.xml
@@ -2,10 +2,10 @@
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="recovery_installing" msgid="2013591905463558223">"מתקין עדכון מערכת"</string>
-    <string name="recovery_erasing" msgid="7334826894904037088">"מוחק"</string>
+    <string name="recovery_erasing" msgid="7334826894904037088">"מתבצעת מחיקה"</string>
     <string name="recovery_no_command" msgid="4465476568623024327">"אין פקודה"</string>
     <string name="recovery_error" msgid="5748178989622716736">"שגיאה!"</string>
-    <string name="recovery_installing_security" msgid="9184031299717114342">"מתקין עדכון אבטחה"</string>
+    <string name="recovery_installing_security" msgid="9184031299717114342">"התקנת עדכון אבטחה מתבצעת"</string>
     <string name="recovery_wipe_data_menu_header" msgid="550255032058254478">"‏לא ניתן לטעון את מערכת Android. ייתכן שהנתונים שלך פגומים. אם הודעה זו תופיע שוב, ייתכן שיהיה עליך לבצע איפוס לנתוני היצרן ולמחוק את כל נתוני המשתמש ששמורים במכשיר זה."</string>
     <string name="recovery_try_again" msgid="7168248750158873496">"ניסיון נוסף"</string>
     <string name="recovery_factory_data_reset" msgid="7321351565602894783">"איפוס לנתוני היצרן"</string>
diff --git a/tools/recovery_l10n/res/values-ky/strings.xml b/tools/recovery_l10n/res/values-ky/strings.xml
index 837cf7d..45fcd15 100644
--- a/tools/recovery_l10n/res/values-ky/strings.xml
+++ b/tools/recovery_l10n/res/values-ky/strings.xml
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
-    <string name="recovery_installing" msgid="2013591905463558223">"Тутум жаңыртуусу орнотулууда"</string>
+    <string name="recovery_installing" msgid="2013591905463558223">"Тутум жаңырууда"</string>
     <string name="recovery_erasing" msgid="7334826894904037088">"Тазаланууда"</string>
     <string name="recovery_no_command" msgid="4465476568623024327">"Буйрук берилген жок"</string>
     <string name="recovery_error" msgid="5748178989622716736">"Ката!"</string>
-    <string name="recovery_installing_security" msgid="9184031299717114342">"Коопсуздук жаңыртуусу орнотулууда"</string>
-    <string name="recovery_wipe_data_menu_header" msgid="550255032058254478">"Android тутуму жүктөлбөй жатат. Дайын-даректериңиз бузук болушу мүмкүн. Бул билдирүү дагы деле келе берсе, түзмөктү кайра башынан жөндөп, анда сакталган бардык колдонуучу дайындарын тазалашыңыз керек."</string>
+    <string name="recovery_installing_security" msgid="9184031299717114342">"Коопсуздук жаңырууда"</string>
+    <string name="recovery_wipe_data_menu_header" msgid="550255032058254478">"Android системасы жүктөлбөй жатат. Дайын-даректериңиз бузук болушу мүмкүн. Бул билдирүү дагы деле келе берсе, түзмөктү кайра башынан жөндөп, анда сакталган бардык колдонуучу дайындарын тазалашыңыз керек."</string>
     <string name="recovery_try_again" msgid="7168248750158873496">"Кайталоо"</string>
     <string name="recovery_factory_data_reset" msgid="7321351565602894783">"Кайра башынан жөндөө"</string>
     <string name="recovery_wipe_data_confirmation" msgid="5439823343348043954">"Колдонуучу дайындарынын баары жашырылсынбы?\n\n МУНУ АРТКА КАЙТАРУУ МҮМКҮН ЭМЕС!"</string>
diff --git a/tools/recovery_l10n/res/values-ne/strings.xml b/tools/recovery_l10n/res/values-ne/strings.xml
index fa53e9d..161d1e4 100644
--- a/tools/recovery_l10n/res/values-ne/strings.xml
+++ b/tools/recovery_l10n/res/values-ne/strings.xml
@@ -6,7 +6,7 @@
     <string name="recovery_no_command" msgid="4465476568623024327">"कुनै आदेश छैन"</string>
     <string name="recovery_error" msgid="5748178989622716736">"त्रुटि!"</string>
     <string name="recovery_installing_security" msgid="9184031299717114342">"सुरक्षा सम्बन्धी अद्यावधिकलाई स्थापना गर्दै"</string>
-    <string name="recovery_wipe_data_menu_header" msgid="550255032058254478">"Android प्रणाली लोड गर्न सकिएन। तपाईंको डेटा बिग्रेको हुन सक्छ। तपाईं यो सन्देश प्राप्त गर्नुहुन्छ भने तपाईंले फ्याक्ट्री डेटा रिसेट गर्न आवश्यक छ र यो यन्त्रमा भण्डारण गरेका सबै प्रयोगकर्ताको डेटा मेट्न पर्छ।"</string>
+    <string name="recovery_wipe_data_menu_header" msgid="550255032058254478">"Android प्रणाली लोड गर्न सकिएन। तपाईंको डेटा बिग्रेको हुन सक्छ। तपाईं यो सन्देश प्राप्त गर्नुहुन्छ भने तपाईंले फ्याक्ट्री डेटा रिसेट गर्न आवश्यक छ र यो डिभाइसमा भण्डारण गरेका सबै प्रयोगकर्ताको डेटा मेट्न पर्छ।"</string>
     <string name="recovery_try_again" msgid="7168248750158873496">"फेरि प्रयास गर्नुहोस्"</string>
     <string name="recovery_factory_data_reset" msgid="7321351565602894783">"फ्याक्ट्री डेटा रिसेट"</string>
     <string name="recovery_wipe_data_confirmation" msgid="5439823343348043954">"प्रयोगकर्ताको सबै डेटा मेट्ने हो?\n\n यो अन्डू गर्न सकिँदैन!"</string>
diff --git a/tools/recovery_l10n/res/values-sv/strings.xml b/tools/recovery_l10n/res/values-sv/strings.xml
index cf43b25..baf8e18 100644
--- a/tools/recovery_l10n/res/values-sv/strings.xml
+++ b/tools/recovery_l10n/res/values-sv/strings.xml
@@ -2,7 +2,7 @@
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="recovery_installing" msgid="2013591905463558223">"Systemuppdatering installeras"</string>
-    <string name="recovery_erasing" msgid="7334826894904037088">"Rensar"</string>
+    <string name="recovery_erasing" msgid="7334826894904037088">"Raderar"</string>
     <string name="recovery_no_command" msgid="4465476568623024327">"Inget kommando"</string>
     <string name="recovery_error" msgid="5748178989622716736">"Fel!"</string>
     <string name="recovery_installing_security" msgid="9184031299717114342">"Säkerhetsuppdatering installeras"</string>
diff --git a/uncrypt/Android.bp b/uncrypt/Android.bp
index 107a7f0..fbb4c1f 100644
--- a/uncrypt/Android.bp
+++ b/uncrypt/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_binary {
     name: "uncrypt",
 
diff --git a/update_verifier/Android.bp b/update_verifier/Android.bp
index f656713..ff2eff9 100644
--- a/update_verifier/Android.bp
+++ b/update_verifier/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_defaults {
     name: "update_verifier_defaults",
 
@@ -112,12 +121,12 @@
 
     version: {
         py2: {
-            enabled: true,
-            embedded_launcher: true,
-        },
-        py3: {
             enabled: false,
             embedded_launcher: false,
         },
+        py3: {
+            enabled: true,
+            embedded_launcher: true,
+        },
     },
 }
diff --git a/update_verifier/care_map_generator.py b/update_verifier/care_map_generator.py
index 051d98d..c6f2dad 100644
--- a/update_verifier/care_map_generator.py
+++ b/update_verifier/care_map_generator.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Copyright (C) 2018 The Android Open Source Project
 #
@@ -115,13 +115,13 @@
     content = input_care_map.read()
 
   if args.parse_proto:
-    result = ParseProtoMessage(content, args.fingerprint_enabled)
+    result = ParseProtoMessage(content, args.fingerprint_enabled).encode()
   else:
     care_map_proto = GenerateCareMapProtoFromLegacyFormat(
         content.rstrip().splitlines(), args.fingerprint_enabled)
     result = care_map_proto.SerializeToString()
 
-  with open(args.output_file, 'w') as output:
+  with open(args.output_file, 'wb') as output:
     output.write(result)
 
 
diff --git a/updater/Android.bp b/updater/Android.bp
index f00a192..35debaa 100644
--- a/updater/Android.bp
+++ b/updater/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 cc_defaults {
     name: "libupdater_static_libs",
 
@@ -27,7 +36,6 @@
         "libfec_rs",
         "libavb",
         "libverity_tree",
-        "libgtest_prod",
         "liblog",
         "liblp",
         "libselinux",
@@ -42,6 +50,9 @@
         "libcutils",
         "libutils",
     ],
+    header_libs: [
+        "libgtest_prod_headers",
+    ],
 }
 
 cc_defaults {
diff --git a/updater/Android.mk b/updater/Android.mk
index 46300d9..bb1c07d 100644
--- a/updater/Android.mk
+++ b/updater/Android.mk
@@ -34,7 +34,6 @@
     libfec_rs \
     libavb \
     libverity_tree \
-    libgtest_prod \
     liblog \
     liblp \
     libselinux \
@@ -72,6 +71,9 @@
 include $(CLEAR_VARS)
 
 LOCAL_MODULE := updater
+LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0
+LOCAL_LICENSE_CONDITIONS := notice
+LOCAL_NOTICE_FILE := $(LOCAL_PATH)/../NOTICE
 
 LOCAL_SRC_FILES := \
     updater_main.cpp
@@ -93,6 +95,8 @@
     libtune2fs \
     $(tune2fs_static_libraries)
 
+LOCAL_HEADER_LIBRARIES := libgtest_prod_headers
+
 LOCAL_MODULE_CLASS := EXECUTABLES
 inc := $(call local-generated-sources-dir)/register.inc
 
diff --git a/updater/updater_runtime.cpp b/updater/updater_runtime.cpp
index e938305..bac078c 100644
--- a/updater/updater_runtime.cpp
+++ b/updater/updater_runtime.cpp
@@ -44,29 +44,25 @@
   return std::string(name);
 }
 
-static struct {
-  const char* name;
-  unsigned flag;
-} mount_flags_list[] = {
-  { "noatime", MS_NOATIME },
-  { "noexec", MS_NOEXEC },
-  { "nosuid", MS_NOSUID },
-  { "nodev", MS_NODEV },
-  { "nodiratime", MS_NODIRATIME },
-  { "ro", MS_RDONLY },
-  { "rw", 0 },
-  { "remount", MS_REMOUNT },
-  { "bind", MS_BIND },
-  { "rec", MS_REC },
-  { "unbindable", MS_UNBINDABLE },
-  { "private", MS_PRIVATE },
-  { "slave", MS_SLAVE },
-  { "shared", MS_SHARED },
-  { "defaults", 0 },
-  { 0, 0 },
-};
-
 static bool setMountFlag(const std::string& flag, unsigned* mount_flags) {
+  static constexpr std::pair<const char*, unsigned> mount_flags_list[] = {
+    { "noatime", MS_NOATIME },
+    { "noexec", MS_NOEXEC },
+    { "nosuid", MS_NOSUID },
+    { "nodev", MS_NODEV },
+    { "nodiratime", MS_NODIRATIME },
+    { "ro", MS_RDONLY },
+    { "rw", 0 },
+    { "remount", MS_REMOUNT },
+    { "bind", MS_BIND },
+    { "rec", MS_REC },
+    { "unbindable", MS_UNBINDABLE },
+    { "private", MS_PRIVATE },
+    { "slave", MS_SLAVE },
+    { "shared", MS_SHARED },
+    { "defaults", 0 },
+  };
+
   for (const auto& [name, value] : mount_flags_list) {
     if (flag == name) {
       *mount_flags |= value;
diff --git a/updater_sample/Android.bp b/updater_sample/Android.bp
index a014248..9222d06 100644
--- a/updater_sample/Android.bp
+++ b/updater_sample/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 android_app {
     name: "SystemUpdaterSample",
     sdk_version: "system_current",
diff --git a/updater_sample/tests/Android.bp b/updater_sample/tests/Android.bp
index 806babd..4bdfe2c 100644
--- a/updater_sample/tests/Android.bp
+++ b/updater_sample/tests/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "bootable_recovery_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["bootable_recovery_license"],
+}
+
 android_test {
     name: "SystemUpdaterSampleTests",
     sdk_version: "system_current",