diff --git a/bash_completion b/bash_completion
deleted file mode 100644
index 63929bb..0000000
--- a/bash_completion
+++ /dev/null
@@ -1,294 +0,0 @@
-# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Add programmable completion to some Chromium OS build scripts
-
-# Declare one cache for all bash complete operations to
-# allow it to be easiley cleared if need be.
-# > unset _comp_cache
-declare -A _comp_cache
-
-# Usage: cros --help | _subcmds_from_help
-# Parse subcommands from a commands's help message.
-# Trims the help outputs after it see any token with "command"
-# in it. Then, it searches for a no-space bracketed token,
-# similar to the following:
-# {subcmd1,subcmd2,subcmd3}
-_subcmds_from_help() {
-  sed -n -e '/commands:/,$p' \
-    | egrep -o '\{[[:alnum:]_,-]+\}' | sort -u \
-    | tr -d '{}' | tr ',' ' '
-  return ${PIPESTATUS[0]}
-}
-
-# Echo a list of -- flags that the current command accepts. The
-# function assumes that the command supports shflags' --help flag.
-_flags() {
-  command "$@" --help 2>&1 \
-    | egrep -o -- '--(\[no\])?[[:alnum:]=_-]+' \
-    | sed -E -e 's|--\[no\](.+)|--\1 --no\1|'
-}
-
-# Complete flags, i.e., current words starting with --. Return 1 if
-# the current word doesn't start with --, 0 otherwise.
-_complete_flag_help() {
-  COMPREPLY=()
-  local cur="${COMP_WORDS[COMP_CWORD]}"
-  if [[ "${cur}" == --* ]]; then
-    local key="flags/${COMP_WORDS[0]}"
-    if [[ -z "${_comp_cache[${key}]}" ]]; then
-      _comp_cache[${key}]="$(_flags "${COMP_WORDS[0]}")"
-    fi
-    COMPREPLY=( $(compgen -W "${_comp_cache[${key}]}" -- "${cur}") )
-    return 0
-  fi
-  return 1
-}
-
-# Look for "--arg=foo" or "--arg foo" (where foo can be an empty string) in the
-# word to be completed. If found, echo "--arg=foo".
-_argeq() {
-  local arg=$1
-  local w0="${COMP_WORDS[COMP_CWORD]}"
-  local w1="${COMP_WORDS[COMP_CWORD-1]}"
-
-  # Check for completing "--arg="
-  if [ "${w1}" == ${arg} -a "${w0}" == "=" ]; then
-    echo "${w1}${w0}"
-    return 0
-  fi
-
-  # Check for completing "--arg foo"
-  if [ "${w1}" == ${arg} ]; then
-    echo "${w1}=${w0}"
-    return 0
-  fi
-
-  # Check for completing "--arg=foo"
-  if [ ${COMP_CWORD} -gt 2 ]; then
-    local w2="${COMP_WORDS[COMP_CWORD-2]}"
-    if [ "${w2}" == ${arg} -a "${w1}" == "=" ]; then
-      echo "${w2}${w1}${w0}"
-      return 0
-    fi
-  fi
-}
-
-
-# echo the existing target board sysroots
-_board_sysroots() {
-  local builddir=/build
-  if [ -d ${builddir} ]; then
-    echo $(command ls "${builddir}")
-  fi
-}
-
-_complete_board_sysroot_flag() {
-  COMPREPLY=()
-  local arg=$(_argeq --board)
-  if [[ ${arg} == --board=* ]]; then
-    COMPREPLY=( $(compgen -W "$(_board_sysroots)" -- ${arg#--board=}) )
-    return 0
-  fi
-  return 1
-}
-
-# Completion for --board= argument for existing board sysroots
-_complete_basic() {
-  _complete_flag_help && return 0
-  _complete_board_sysroot_flag && return 0
-}
-
-# echo the existing target board overlays
-_board_overlays() {
-  local overlaydir=../overlays
-  if [ -d ${overlaydir} ]; then
-    echo $(command ls $overlaydir | grep overlay- | sed s,overlay-,,)
-  fi
-}
-
-# Completion for --board= argument for existing board overlays
-_board_overlay() {
-  _complete_flag_help && return 0
-
-  COMPREPLY=()
-  local arg=$(_argeq --board)
-  if [[ ${arg} == --board=* ]]; then
-    COMPREPLY=( $(compgen -W "$(_board_overlays)" -- ${arg#--board=}) )
-  fi
-}
-
-# Completion for -c and -s argument for autotest script
-_ls_autotest() {
-  local autotest_dir=../third_party/autotest/files
-  ls --color=never -dBFH ${autotest_dir}/$1* 2>/dev/null \
-    | sed s/"..\/third_party\/autotest\/files\/"//g
-}
-
-_autotest_complete() {
-  _complete_flag_help && return 0
-
-  local arg=$(_argeq -c)
-  if [[ ${arg} == -c=* ]]; then
-    COMPREPLY=($(compgen -W "$(_ls_autotest ${arg#-c=})"))
-    return 0
-  fi
-
-  arg=$(_argeq -s)
-  if [[ ${arg} == -s=* ]]; then
-    COMPREPLY=($(compgen -W "$(_ls_autotest ${arg#-s=})"))
-    return 0
-  fi
-
-  _complete_board_sysroot_flag && return 0
-}
-
-_test_that_complete() {
-  _complete_flag_help && return 0
-  return 0
-}
-
-# Complete cros_workon's <command> argument.
-#
-# TODO(petkov): We should probably extract the list of commands from
-# cros_workon --help, just like we do for flags (see _complete_flag_help).
-#
-# TODO(petkov): Currently, this assumes that the command is the first
-# argument. In practice, the command is the first non-flag
-# argument. I.e., this should be fixed to support something like
-# "cros_workon --all list".
-_complete_cros_workon_command() {
-  [ ${COMP_CWORD} -eq 1 ] || return 1
-  local command="${COMP_WORDS[1]}"
-
-  # TODO(hesling): Local scoped references to associative arrays
-  # seems to be broken in bash version 4.3.48, but working in version 5.
-  # We can beautify this by using the following command, when cros bash
-  # is updated.
-  # local -n cache="_comp_cache[subcmds/cros_workon]"
-
-  local key="subcmds/cros_workon"
-  if [[ -z "${_comp_cache[${key}]}" ]]; then
-    _comp_cache[${key}]="$(command cros_workon --help | _subcmds_from_help)"
-  fi
-  COMPREPLY=($(compgen -W "${_comp_cache[${key}]}" -- "${command}"))
-  return 0
-}
-
-# Prints the full path to the cros_workon executable, handling tilde
-# expansion for the current user.
-_cros_workon_executable() {
-  local cros_workon="${COMP_WORDS[0]}"
-  if [[ "$cros_workon" == '~/'* ]]; then
-    cros_workon="$HOME/${cros_workon#'~/'}"
-  fi
-  echo "$cros_workon"
-}
-
-# Lists the workon (or live, if --all is passed in) ebuilds. Lists
-# both the full names (e.g., chromeos-base/metrics) as well as just
-# the ebuild names (e.g., metrics).
-_cros_workon_list() {
-  local cros_workon=$(_cros_workon_executable)
-  ${cros_workon} $1 list | sed 's,\(.\+\)/\(.\+\),\1/\2 \2,'
-}
-
-# Completes the current cros_workon argument assuming it's a
-# package/ebuild name.
-_complete_cros_workon_package() {
-  [ ${COMP_CWORD} -gt 1 ] || return 1
-  local package="${COMP_WORDS[COMP_CWORD]}"
-  local command="${COMP_WORDS[1]}"
-  # If "start", complete based on all workon packages.
-  if [[ ${command} == "start" ]]; then
-    local key="pkgs/all"
-    if [[ -z "${_comp_cache[${key}]}" ]]; then
-      _comp_cache[${key}]="$(_cros_workon_list --all)"
-    fi
-    COMPREPLY=($(compgen -W "${_comp_cache[${key}]}" -- "${package}"))
-    return 0
-  fi
-  # If "stop" or "iterate", complete based on all live packages.
-  if [[ ${command} == "stop" ]] || [[ ${command} == "iterate" ]]; then
-    COMPREPLY=($(compgen -W "$(_cros_workon_list)" -- "$package"))
-    return 0
-  fi
-  return 1
-}
-
-# Complete cros_workon arguments.
-_cros_workon() {
-  COMPREPLY=()
-  _complete_flag_help && return 0
-  _complete_board_sysroot_flag && return 0
-  _complete_cros_workon_command && return 0
-  _complete_cros_workon_package && return 0
-  return 0
-}
-
-_complete_cros_command() {
-  local command="${COMP_WORDS[COMP_CWORD]}"
-  if [ ${COMP_CWORD} -ne 1 ]; then
-    return 1
-  fi
-
-  local key="subcmds/cros"
-  if [[ -z "${_comp_cache[${key}]}" ]]; then
-    _comp_cache[${key}]="$(command cros --help | _subcmds_from_help)"
-  fi
-  COMPREPLY=($(compgen -W "${_comp_cache[${key}]}" -- "${command}"))
-  return 0
-}
-
-# Complete cros arguments.
-_cros() {
-  COMPREPLY=()
-  _complete_flag_help && return 0
-  _complete_board_sysroot_flag && return 0
-  _complete_cros_command && return 0
-  # TODO(hesling): Add package completion like cros_workon.
-  return 0
-}
-
-# Complete equery's <module-name> argument.
-_complete_equery_module_name() {
-  [ ${COMP_CWORD} -eq 1 ] || return 1
-  local command="${COMP_WORDS[1]}"
-  COMPREPLY=($(compgen -W "belongs changes check depends depgraph files has \
-                           hasuse keywords list meta size uses which" \
-                           -- "$command"))
-  return 0
-}
-
-# Complete equery arguments.
-_complete_equery() {
-  COMPREPLY=()
-  _complete_equery_module_name && return 0
-  return 0
-}
-
-complete -o bashdefault -o default -F _complete_basic \
-  build_autotest.sh \
-  build_image \
-  build_packages \
-  mod_image_for_test.sh \
-  cros_portage_upgrade
-
-complete -o bashdefault -o default -F _board_overlay setup_board
-complete -o bashdefault -o default -o nospace -F _autotest_complete autotest
-complete -o bashdefault -o default -o nospace -F _test_that_complete test_that
-complete -o bashdefault -o default -F _cros cros
-complete -F _cros_workon cros_workon
-complete -o bashdefault -o default -F _complete_equery equery
-
-# Use equery completion for equery-$board for known boards
-_boardlist=$(cros_list_overlays | egrep "^.*/overlays/overlay-.*$" |
-             sed -n "s/.*overlay-//p")
-for board in $_boardlist; do
-  complete -o bashdefault -o default -F _complete_equery equery-$board
-done
-
-###  Local Variables:
-###  mode: shell-script
-###  End:
diff --git a/build_library/base_image_util.sh b/build_library/base_image_util.sh
index 1f049c8..d152d70 100755
--- a/build_library/base_image_util.sh
+++ b/build_library/base_image_util.sh
@@ -412,7 +412,7 @@
     "${arc_flags[@]}"
 
   # Copy the full lsb-release into the initramfs build root.
-  if has "minios" "$(portageq-${FLAGS_board} envvar USE)"; then
+  if has "minios" "$(portageq-"${BOARD}" envvar USE)"; then
     sudo mkdir -p "${BOARD_ROOT}/build/initramfs/etc"
     sudo cp "${root_fs_dir}/etc/lsb-release" \
       "${BOARD_ROOT}/build/initramfs/etc/"
@@ -456,16 +456,27 @@
     enable_bootcache="--enable_bootcache"
   fi
 
-  ${BUILD_LIBRARY_DIR}/create_legacy_bootloader_templates.sh \
-    --arch=${ARCH} \
-    --board=${BOARD} \
-    --image_type="${image_type}" \
-    --to="${root_fs_dir}"/boot \
-    --boot_args="${FLAGS_boot_args}" \
-    --enable_serial="${FLAGS_enable_serial}" \
-    --loglevel="${FLAGS_loglevel}" \
+  # If the KERN-A partition is of type "reserved", there is no kernel.
+  # Skip the preparation of a bootable kernel partition.
+  local has_bootable_kernel=1
+  local kernel_part_num="$(get_layout_partition_number "${image_type}" KERN-A)"
+  local kernel_part_type="$(get_type "${image_type}" "${kernel_part_num}")"
+  if [[ "${kernel_part_type}" == "reserved" ]]; then
+    has_bootable_kernel=0
+  fi
+
+  if [[ "${has_bootable_kernel}" -eq 1 ]]; then
+    ${BUILD_LIBRARY_DIR}/create_legacy_bootloader_templates.sh \
+      --arch=${ARCH} \
+      --board=${BOARD} \
+      --image_type="${image_type}" \
+      --to="${root_fs_dir}"/boot \
+      --boot_args="${FLAGS_boot_args}" \
+      --enable_serial="${FLAGS_enable_serial}" \
+      --loglevel="${FLAGS_loglevel}" \
       ${enable_rootfs_verification} \
       ${enable_bootcache}
+  fi
 
   # Run board-specific build image function, if available.
   if type board_finalize_base_image &>/dev/null; then
@@ -506,8 +517,12 @@
 
   # Generate DLCs and copy their metadata to the rootfs + factory install DLC
   # images into stateful partition.
-  build_dlc --sysroot="${BOARD_ROOT}" --rootfs="${root_fs_dir}" \
-    --stateful="${stateful_fs_dir}" --board="${BOARD}" --factory-install
+  if should_build_image ${CHROMEOS_FACTORY_INSTALL_SHIM_NAME}; then
+    info "Skipping DLC copying for factory shim images."
+  else
+    build_dlc --sysroot="${BOARD_ROOT}" --rootfs="${root_fs_dir}" \
+      --stateful="${stateful_fs_dir}" --board="${BOARD}" --factory-install
+  fi
 
   restore_fs_contexts "${BOARD_ROOT}" "${root_fs_dir}" "${stateful_fs_dir}"
 
@@ -516,25 +531,28 @@
   # the bootable partitions later.
   mkdir -p "${BUILD_DIR}/boot_images"
 
-  # We either copy or move vmlinuz depending on whether it should be included
-  # in the final built image.  Boards that boot with legacy bioses
-  # need the kernel on the boot image, boards with coreboot/depthcharge
-  # boot from a boot partition.
-  if has "include_vmlinuz" "$(portageq-${FLAGS_board} envvar USE)"; then
-    cpmv="cp"
-  else
-    cpmv="mv"
-  fi
-
-  # Bootable kernel image for ManaTEE enabled targets is located at
-  # directory /build/manatee/boot and included only in bootable partition.
-  # If no manatee USE flag is specified the standard /boot location
-  # is used, optionally including kernel image in final build image.
+  # Bootable kernel image for ManaTEE enabled targets is located at directory
+  # ${BOARD_ROOT}/build/manatee/boot and included only in bootable partition.
+  # If no manatee USE flag is specified the standard /boot location is used,
+  # optionally including kernel image in final build image:
+  # - boards that boot with legacy bioses need the kernel on the boot image
+  # - boards with coreboot/depthcharge boot from a boot partition.
   local boot_dir
-  if has "manatee" "$(portageq-${FLAGS_board} envvar USE)"; then
-    boot_dir="${root_fs_dir}/build/manatee/boot"
+  local cpmv
+  if has "manatee" "$(portageq-"${BOARD}" envvar USE)"; then
+    boot_dir="${BOARD_ROOT}/build/manatee/boot"
+    cpmv="cp"
+    # The CrOS VM (guest) kernel goes into initramfs, so we should drop it
+    # from rootfs to save space.
+    sudo rm "${root_fs_dir}"/boot/vmlinuz-*
+    sudo rm "${root_fs_dir}"/boot/vmlinuz
   else
     boot_dir="${root_fs_dir}/boot"
+    if has "include_vmlinuz" "$(portageq-"${BOARD}" envvar USE)"; then
+      cpmv="cp"
+    else
+      cpmv="mv"
+    fi
   fi
 
   [ -e "${boot_dir}"/Image-* ] && \
@@ -571,14 +589,15 @@
     USE_DEV_KEYS="--use_dev_keys"
   fi
 
-  if [[ ${skip_kernelblock_install} -ne 1 ]]; then
+  if [[ "${skip_kernelblock_install}" -ne 1 \
+    && "${has_bootable_kernel}" -eq 1 ]]; then
     # Place flags before positional args.
     ${SCRIPTS_DIR}/bin/cros_make_image_bootable "${BUILD_DIR}" \
       ${image_name} ${USE_DEV_KEYS} --adjust_part="${FLAGS_adjust_part}"
   fi
 
   # Build minios kernel and put it in the MINIOS-A partition of the image.
-  if has "minios" "$(portageq-${FLAGS_board} envvar USE)"; then
+  if has "minios" "$(portageq-"${BOARD}" envvar USE)"; then
     build_minios --board "${BOARD}" --image "${BUILD_DIR}/${image_name}" \
       --version "${CHROMEOS_VERSION_STRING}"
   fi
diff --git a/build_library/dev_image_util.sh b/build_library/dev_image_util.sh
index 902ef73..57c17e6 100755
--- a/build_library/dev_image_util.sh
+++ b/build_library/dev_image_util.sh
@@ -85,4 +85,12 @@
         ${image_name} --force_developer_mode
     fi
   fi
+
+  # Update MINIOS-A partition with developer mode image. This does not rebuild
+  # the MiniOS image. It only enables/adds dev-mode flags.
+  if has "minios" "$(portageq-"${BOARD}" envvar USE)"; then
+    build_minios --mod-for-dev --board "${BOARD}" \
+      --image "${BUILD_DIR}/${image_name}" \
+      --version "${CHROMEOS_VERSION_STRING}"
+  fi
 }
diff --git a/build_library/ext2_sb_util.sh b/build_library/ext2_sb_util.sh
index 65380f6..52b5446 100644
--- a/build_library/ext2_sb_util.sh
+++ b/build_library/ext2_sb_util.sh
@@ -20,9 +20,9 @@
 # mount the filesystem as read-write -- only read-only[2].
 #
 # [1] 32-bit flag we are modifying:
-#  https://chromium.googlesource.com/chromiumos/third_party/kernel.git/+/master/include/linux/ext2_fs.h#l417
+#  https://chromium.googlesource.com/chromiumos/third_party/kernel.git/+/HEAD/include/linux/ext2_fs.h#l417
 # [2] Mount behavior is enforced here:
-#  https://chromium.googlesource.com/chromiumos/third_party/kernel.git/+/master/ext2/super.c#l857
+#  https://chromium.googlesource.com/chromiumos/third_party/kernel.git/+/HEAD/ext2/super.c#l857
 #
 # N.B., if the high order feature bits are used in the future, we will need to
 #       revisit this technique.
diff --git a/build_packages b/build_packages
index a781f3a..68dc80e 100755
--- a/build_packages
+++ b/build_packages
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
+# Copyright 2022 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
@@ -9,492 +9,12 @@
 # Script must run inside the chroot
 restart_in_chroot_if_needed "$@"
 
-assert_not_root_user
-
-# Developer-visible flags.
-DEFINE_string board "${DEFAULT_BOARD}" \
-  "The board to build packages for."
-DEFINE_boolean usepkg "${FLAGS_TRUE}" \
-  "Use binary packages to bootstrap when possible."
-DEFINE_boolean usepkgonly "${FLAGS_FALSE}" \
-  "Only use binary packages to bootstrap; abort if any are missing."
-DEFINE_boolean workon "${FLAGS_TRUE}" \
-  "Force-build workon packages."
-DEFINE_boolean showoutput "${FLAGS_FALSE}" \
-  "Show all output from parallel_emerge."
-DEFINE_boolean withautotest "${FLAGS_TRUE}" \
-  "Build autotest client code."
-DEFINE_boolean withdebugsymbols "${FLAGS_FALSE}" \
-  "Install the debug symbols for all packages"
-DEFINE_string eventfile "${DEFAULT_EVENT_FILE}" \
-  "Define the file that event logs will be written."
-DEFINE_boolean withrevdeps "${FLAGS_TRUE}" \
-  "Calculate reverse dependencies on changed ebuilds."
-DEFINE_boolean autosetgov "${FLAGS_FALSE}" \
-  "Automatically set cpu governor to 'performance'."
-DEFINE_boolean use_any_chrome "${FLAGS_TRUE}" \
-  "Use any Chrome prebuilt available, even if the prebuilt doesn't match exactly."
-DEFINE_boolean cleanbuild "${FLAGS_FALSE}" \
-  "Perform a clean build; delete sysroot if it exists before building."
-DEFINE_boolean internal "${FLAGS_FALSE}" \
-  "Build the internal version of chrome (set the chrome_internal USE flag)."
-DEFINE_boolean pretend "${FLAGS_FALSE}" \
-  "Don't build packages, just display which packages would have been installed."
-
-# The --board_root flag specifies the environment variables ROOT and PKGDIR.
-# This allows fetching and emerging of all packages to specified board_root.
-# Note that --board_root will setup the board normally in /build/$BOARD, if it's
-# not setup yet. It also expects the toolchain to already be installed in the
-# board_root. --usepkgonly and --norebuild are required, because building is not
-# supported when board_root is set.
-# enforce this)."
-DEFINE_string board_root "" \
-  "Emerge packages to board_root."
-
-FLAGS_HELP="usage: $(basename $0) [flags] [packages]
-
-build_packages updates the set of binary packages needed by Chrome OS. It will
-cross compile all packages that have been updated into the given target's root
-and build binary packages as a side-effect. The output packages will be picked
-up by the build_image script to put together a bootable Chrome OS image.
-
-If [packages] are specified, only build those specific packages (and any
-dependencies they might need).
-
-For the fastest builds, use --nowithautotest --noworkon.
-"
-
-# The following options are advanced options, only available to those willing
-# to read the source code. They are not shown in help output, since they are
-# not needed for the typical developer workflow.
-DEFINE_string accept_licenses "" \
-  "Licenses to append to the accept list."
-DEFINE_boolean eclean "${FLAGS_TRUE}" \
-  "Run eclean to delete old binpkgs."
-DEFINE_integer jobs -1 \
-  "How many packages to build in parallel at maximum."
-DEFINE_boolean norebuild "${FLAGS_FALSE}" \
-  "Don't automatically rebuild dependencies."
-DEFINE_boolean skip_chroot_upgrade "${FLAGS_FALSE}" \
-  "Don't run the chroot upgrade automatically; use with care."
-DEFINE_boolean skip_setup_board "${FLAGS_FALSE}" \
-  "Don't run setup_board. Implies skip_chroot_upgrade and" \
-  "skip_toolchain_update."
-DEFINE_boolean skip_toolchain_update "${FLAGS_FALSE}" \
-  "Don't update toolchain automatically."
-DEFINE_boolean withdev "${FLAGS_TRUE}" \
-  "Build useful developer friendly utilities."
-DEFINE_boolean withdebug "${FLAGS_TRUE}" \
-  "Build debug versions of Chromium-OS-specific packages."
-DEFINE_boolean withfactory "${FLAGS_TRUE}" \
-  "Build factory installer."
-DEFINE_boolean withtest "${FLAGS_TRUE}" \
-  "Build packages required for testing."
-DEFINE_boolean expandedbinhosts "${FLAGS_TRUE}" \
-  "Allow expanded binhost inheritance."
-
-# The --reuse_pkgs_from_local_boards flag tells Portage to share binary
-# packages between boards that are built locally, so that the total time
-# required to build several boards is reduced. This flag is only useful
-# when you are not able to use remote binary packages, since remote binary
-# packages are usually more up to date than anything you have locally.
-DEFINE_boolean reuse_pkgs_from_local_boards "${FLAGS_FALSE}" \
-  "Bootstrap from local packages instead of remote packages."
-
-# --run_goma option is designed to be used on bots.
-# If you're trying to build pacakges with goma in your local dev env, this is
-# *not* the option you're looking for. Please see comments below.
-# This option; 1) starts goma, 2) builds packages (expecting that goma is
-# used), then 3) stops goma explicitly.
-# 3) is a request from the goma team, so that stats/logs can be taken.
-# Note: GOMA_DIR and GOMA_SERVICE_ACCOUNT_JSON_FILE are expected to be passed
-# via env var.
-#
-# In local dev env cases, compiler_proxy is expected to keep running.
-# In such a case;
-#   $ python ${GOMA_DIR}/goma_ctl.py ensure_start
-#   $ ./build_packages (... and options without --run_goma ...)
-# is an expected commandline sequence. If you set --run_goma flag while
-# compiler_proxy is already running, the existing compiler_proxy will be
-# stopped.
-DEFINE_boolean run_goma "${FLAGS_FALSE}" \
-  "If set to true, (re)starts goma, builds packages, and then stops goma."
-
-# Parse command line
-FLAGS "$@" || exit 1
-eval set -- "${FLAGS_ARGV}"
-
-# Die on any errors.
-switch_to_strict_mode
-
-# Chrome packages that need to be treated the same. These are the chrome and
-# chrome follow-on packages that share the same version as chrome and are
-# updated in lock step.
-CHROME_PACKAGES=(
-  "chromeos-base/chromeos-chrome"
-  "chromeos-base/chrome-icu"
-)
-
-if [[ "${FLAGS_internal}" -eq "${FLAGS_TRUE}" ]]; then
-  export USE="${USE} chrome_internal"
-fi
-
-# This is a temporary measure to help the goma team check the configs while
-# they transition their backend service.
-# TODO(crbug.com/1032290): Delete after the goma RBE transition is complete.
-if [[ "${FLAGS_run_goma}" -eq "${FLAGS_TRUE}" ]]; then
-  info "Environment:"
-  env
-  info "End Environment."
-fi
-
-# Right now build_packages has to be run from scripts/
-. ${SRC_ROOT}/third_party/chromiumos-overlay/chromeos/config/chromeos_version.sh
-
-# On some systems, powersave can take a long time to ramp up.  Inform the user
-# so they can get faster builds.  https://crbug.com/1008932
-if grep -qs powersave \
-     /sys/devices/system/cpu/cpufreq/policy*/scaling_governor; then
-  # Make sure we can actually support "performance".
-  if grep -qs performance \
-      /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors; then
-    if [[ "${FLAGS_autosetgov}" -eq "${FLAGS_TRUE}" ]]; then
-      info "Temporarily setting cpu governor to 'performance'"
-      trap "sudo cpupower -c all frequency-set -g powersave >&/dev/null" EXIT
-      sudo cpupower -c all frequency-set -g performance >&/dev/null
-    else
-      warn "Current CPU governor set to 'powersave' which can slow down builds."
-      warn "Use --autosetgov to automatically (and temporarily) switch to" \
-        "'performance'."
-    fi
-  fi
-fi
-
-if [[ -z "${FLAGS_board}" ]]; then
-  echo "Error: --board is required."
-  exit 1
-fi
-
-if [[ "${FLAGS_skip_setup_board}" -eq "${FLAGS_FALSE}" ]]; then
-  # Before we can run any tools, we need to update chroot or setup_board.
-  UPDATE_ARGS=()
-  if [[ -n ${FLAGS_accept_licenses} ]]; then
-    UPDATE_ARGS+=( --accept-licenses "${FLAGS_accept_licenses}" )
-  fi
-  if [ "${FLAGS_usepkg}" -eq "${FLAGS_TRUE}" ]; then
-    UPDATE_ARGS+=( --usepkg )
-  else
-    UPDATE_ARGS+=( --nousepkg )
-  fi
-  if [[ "${FLAGS_jobs}" -ne -1 ]]; then
-    UPDATE_ARGS+=( --jobs=${FLAGS_jobs} )
-  fi
-  if [ "${FLAGS_reuse_pkgs_from_local_boards}" -eq "${FLAGS_TRUE}" ]; then
-    UPDATE_ARGS+=( --reuse-pkgs-from-local-boards )
-  fi
-  if [ "${FLAGS_skip_toolchain_update}" -eq "${FLAGS_TRUE}" ]; then
-    UPDATE_ARGS+=( --skip-toolchain-update )
-  fi
-  if [ "${FLAGS_skip_chroot_upgrade}" -eq "${FLAGS_TRUE}" ]; then
-    UPDATE_ARGS+=( --skip-chroot-upgrade )
-  fi
-  if [[ -n ${FLAGS_board_root} ]]; then
-    UPDATE_ARGS+=( --board-root "${FLAGS_board_root}" )
-  fi
-  if [ "${FLAGS_cleanbuild}" -eq "${FLAGS_TRUE}" ]; then
-    UPDATE_ARGS+=( --force )
-  fi
-  if [[ "${FLAGS_expandedbinhosts}" -eq "${FLAGS_FALSE}" ]]; then
-    UPDATE_ARGS+=( --fewer-binhosts )
-  fi
-
-  setup_board --quiet --board=${FLAGS_board} "${UPDATE_ARGS[@]}"
-fi
-
-sudo_clear_shadow_locks "/build/${FLAGS_board}"
-PORTAGE_BINHOST=$(portageq-${FLAGS_board} envvar 'PORTAGE_BINHOST')
-info "PORTAGE_BINHOST: ${PORTAGE_BINHOST}"
-
-
-# Setup all the emerge command/flags.
-EMERGE_FLAGS=( -uDNv --backtrack=30 --newrepo --with-test-deps y )
-
-EMERGE_CMD=(
-  "${CHROMITE_BIN}/parallel_emerge"
-  --board=${FLAGS_board}
-)
-
-if [[ "${FLAGS_use_any_chrome}" -eq "${FLAGS_TRUE}" ]]; then
-  for pkg in "${CHROME_PACKAGES[@]}"; do
-    EMERGE_CMD+=( "--force-remote-binary=${pkg}" )
-  done
-fi
-
-EMERGE_CMD+=( ${EXTRA_BOARD_FLAGS} )
-
-if [[ "${FLAGS_pretend}" -eq "${FLAGS_TRUE}" ]]; then
-  EMERGE_FLAGS+=( "--pretend" )
-fi
-
-if [[ "${FLAGS_usepkg}" -eq "${FLAGS_TRUE}" ||
-      "${FLAGS_reuse_pkgs_from_local_boards}" -eq "${FLAGS_TRUE}" ||
-      "${FLAGS_usepkgonly}" -eq "${FLAGS_TRUE}" ]]; then
-  # Use binary packages. Include all build-time dependencies,
-  # so as to avoid unnecessary differences between source
-  # and binary builds.
-  EMERGE_FLAGS+=( --getbinpkg --with-bdeps y )
-  if [[ ${FLAGS_usepkgonly} -eq ${FLAGS_TRUE} ]]; then
-    EMERGE_FLAGS+=( --usepkgonly )
-  else
-    EMERGE_FLAGS+=( --usepkg )
-  fi
-fi
-
-if [[ "${FLAGS_jobs}" -ne -1 ]]; then
-  EMERGE_FLAGS+=( --jobs=${FLAGS_jobs} )
-fi
-
-if [[ "${FLAGS_norebuild}" -eq "${FLAGS_FALSE}" ]]; then
-  EMERGE_FLAGS+=( --rebuild-if-new-rev )
-fi
-if [[ "${FLAGS_showoutput}" -eq "${FLAGS_TRUE}" ]]; then
-  EMERGE_FLAGS+=( --show-output )
-fi
-
-if [[ "${FLAGS_withdebug}" -eq "${FLAGS_FALSE}" ]]; then
-  export USE="${USE} -cros-debug"
-fi
-
-# Figure out which packages we should be building.
-PACKAGES=( "$@" )
-FORCE_LOCAL_BUILD_PKGS=()
-if [[ $# -eq 0 ]]; then
-  PACKAGES=( virtual/target-os )
-  if [[ "${FLAGS_withdev}" -eq "${FLAGS_TRUE}" ]]; then
-    PACKAGES+=( virtual/target-os-dev )
-  fi
-  if [[ "${FLAGS_withfactory}" -eq "${FLAGS_TRUE}" ]]; then
-    PACKAGES+=( virtual/target-os-factory )
-    PACKAGES+=( virtual/target-os-factory-shim )
-  fi
-  if [[ "${FLAGS_withtest}" -eq "${FLAGS_TRUE}" ]]; then
-    PACKAGES+=( virtual/target-os-test )
-    # chromeos-ssh-testkeys may generate ssh keys if the right USE flag is set.
-    # We force rebuilding this package from source every time, so that
-    # consecutive builds don't share ssh keys.
-    FORCE_LOCAL_BUILD_PKGS+=( chromeos-base/chromeos-ssh-testkeys )
-  fi
-  if [[ "${FLAGS_withautotest}" -eq "${FLAGS_TRUE}" ]]; then
-    PACKAGES+=( chromeos-base/autotest-all )
-  fi
-fi
-
-info "Rebuilding Portage cache"
-# Before running any emerge operations, regenerate the Portage dependency cache
-# in parallel.
-info_run "${EMERGE_CMD[@]}" --regen --quiet
-
-# Clean out any stale binpkgs we've accumulated. This is done immediately after
-# regenerating the cache in case ebuilds have been removed (e.g. from a revert).
-if [[ "${FLAGS_eclean}" -eq "${FLAGS_TRUE}" ]]; then
-  info "Cleaning stale binpkgs"
-  get_eclean_exclusions | "eclean-${FLAGS_board}" -e /dev/stdin packages
-fi
-
-# Verify that all packages can be emerged from scratch, without any
-# backtracking. Only print the output if this step fails.
-info "Checking package dependencies are correct: ${PACKAGES[*]}"
-if ! OUTPUT=$(emerge-${FLAGS_board} -pe --backtrack=0 \
-              "${PACKAGES[@]}" 2>&1); then
-  printf "%s\n" "${OUTPUT}"
-  die_notrace "emerge detected broken ebuilds. See error message above."
-fi
-
-# Build cros_workon packages when they are changed.
-CROS_WORKON_PKGS=()
-if [ "${FLAGS_workon}" -eq "${FLAGS_TRUE}" ]; then
-  LIST_MODIFIED_PACKAGES="${CHROMITE_BIN}/cros_list_modified_packages"
-  MODIFIED_PACKAGES=( $("${LIST_MODIFIED_PACKAGES}" --board=${FLAGS_board}) )
-  info "cros_workon modified packages '${MODIFIED_PACKAGES[*]}' detected"
-  CROS_WORKON_PKGS+=( "${MODIFIED_PACKAGES[@]}" )
-
-  # TODO(anush): Make chrome a fake cros-workon package.
-  if [[ -n "${CHROME_ORIGIN}" ]]; then
-    CROS_WORKON_PKGS+=( "${CHROME_PACKAGES[@]}" )
-  fi
-fi
-
-# cros_workon packages always have to be rebuilt.
-FORCE_LOCAL_BUILD_PKGS+=( "${CROS_WORKON_PKGS[@]}" )
-
-# Any package that directly depends on an active cros_workon package also needs
-# to be rebuilt in order to be correctly built against the current set of
-# changes a user may have made to the cros_workon package.
-if [[ ${#CROS_WORKON_PKGS[@]} -gt 0 ]]; then
-  # Collect all installed packages that depend on active cros_workon packages.
-  WORKON_PKG_CONSUMERS=()
-  mapfile -t WORKON_PKG_CONSUMERS < <( \
-    equery-${FLAGS_board} -q depends "${CROS_WORKON_PKGS[@]}" | \
-    sort -u | \
-    grep -Ev "^\s*$" )
-
-  # Transform this list of packages with versions in to a list of just
-  # $CATEGORY/$NAME entries, since we don't want to pass packages with explicit
-  # version numbers as arguments to `emerge`.
-  if [[ ${#WORKON_PKG_CONSUMERS[@]} -gt 0 ]]; then
-    WORKON_REBUILD_PKGS=()
-    mapfile -t WORKON_REBUILD_PKGS < <( \
-      equery-${FLAGS_board} list -p -o --format='$category/$name' \
-        "${WORKON_PKG_CONSUMERS[@]}" | sort -u )
-
-    info "The following packages depend directly on an active" \
-      "cros_workon package and will be rebuilt: ${WORKON_REBUILD_PKGS[*]}"
-
-    FORCE_LOCAL_BUILD_PKGS+=( "${WORKON_REBUILD_PKGS[@]}" )
-  fi
-fi
-
-if [[ -n "${FLAGS_board_root}" ]]; then
-  export ROOT="${FLAGS_board_root}"
-  export PORTAGE_CONFIGROOT="${ROOT}"
-  export SYSROOT="${ROOT}"
-  export PKGDIR="${ROOT}"/packages
-fi
-
-# Temporarily modify the emerge flags so we can calculate the revdeps
-# on the modified packages.
-if [[ "${FLAGS_withrevdeps}" -eq "${FLAGS_TRUE}" ]]; then
-  info "starting reverse dependency calculations ..."
-  SIM_EMERGE_FLAGS=( "${EMERGE_FLAGS[@]}" --pretend --columns )
-
-  if [[ ${#PACKAGES[@]} -gt 0 ]]; then
-    SIM_EMERGE_FLAGS+=(
-      --reinstall-atoms="${PACKAGES[*]}"
-      --usepkg-exclude="${PACKAGES[*]}"
-    )
-  fi
-
-  # cros-workon packages are always going to be force reinstalled, so we add
-  # the forced reinstall behavior to the modified package calculation. This is
-  # necessary to include when a user has already installed a 9999 ebuild and is
-  # now reinstalling that package with additional local changes, because
-  # otherwise the modified package calculation would not see that a 'new'
-  # package is being installed.
-  if [[ ${#CROS_WORKON_PKGS[@]} -gt 0 ]]; then
-    SIM_EMERGE_FLAGS+=(
-      --reinstall-atoms="${CROS_WORKON_PKGS[*]}"
-      --usepkg-exclude="${CROS_WORKON_PKGS[*]}"
-    )
-  fi
-
-  # Calculate only the ebuild changes from the emerge simulation ignoring
-  # the virtual packages and the forced rebuild of autotest-all package.
-  # The lines of the following block do the following operations:
-  # 1. Do a pretend `emerge` command to get a list of what would be built.
-  # 2. Filter to only packages that will be installed to the board sysroot.
-  # 3. Filter to only packages that would be built from source and rewrite the
-  #    line from Portage's full output to only $CATEGORY/$PACKAGE
-  # 4. Filter the list of packages to a heuristic set of packages known to have
-  #    incorrectly specified dependencies.
-  # 5. Sort the output and remove any duplicate entries.
-  BASE_INSTALL_PKGS=( $( \
-    sudo -E "${EMERGE_CMD[@]}" "${SIM_EMERGE_FLAGS[@]}" "${PACKAGES[@]}" | \
-    grep -e 'to /build/' | \
-    sed -n -E '/^\[ebuild /{s:^[^]]+\] +::;s: .*::;p}' | \
-    grep -E '/(coreboot-private-files.*|tast-build-deps)$' | \
-    sort -u ) )
-
-  MOD_PKGS=()
-  if [[ "${#BASE_INSTALL_PKGS[@]}" -gt 0 ]]; then
-    info "Forced rebuild packages detected: ${BASE_INSTALL_PKGS[*]}."
-    # Convert specific versions into base package names
-    MOD_PKGS+=( $(\
-    equery-${FLAGS_board} list -p -o --format='$category/$name' \
-      "${BASE_INSTALL_PKGS[@]}" | sort -u ) )
-    # Remove Chrome as rebuilding it is expensive and almost never makes sense.
-    # Ignore grep exit status in case chromeos-chrome is the only package.
-    grep_cmd=( grep -v )
-    for pkg in "${CHROME_PACKAGES[@]}"; do
-      grep_cmd+=( -e "${pkg}" )
-    done
-    MOD_PKGS=( $(printf '%s\n' "${MOD_PKGS[@]}" | "${grep_cmd[@]}" || :) )
-  fi
-
-  FORCE_LOCAL_BUILD_PKGS+=( "${MOD_PKGS[@]}" )
-
-  if [[ "${#MOD_PKGS[@]}" -gt 0 ]]; then
-    info "calculating reverse dependencies on packages: ${MOD_PKGS[*]}"
-    REV_DEPS=( $(\
-      equery-${FLAGS_board} -q depends --indirect "${MOD_PKGS[@]}" |\
-      awk '{print $1}' | grep -v ^virtual/ | sort -u) )
-    if [[ "${#REV_DEPS[@]}" -gt 0 ]]; then
-      # Convert specific versions into base package names
-      RMOD_PKGS=( $(\
-        equery-${FLAGS_board} -q list -p -o --format='$category/$name' \
-        "${REV_DEPS[@]}" | sort -u ) )
-      # Remove Chrome as rebuilding it is expensive and almost never makes
-      # sense.  Ignore grep exit status in case chromeos-chrome is the only
-      # package.
-      grep_cmd=( grep -v )
-      for pkg in "${CHROME_PACKAGES[@]}"; do
-        grep_cmd+=( -e "${pkg}" )
-      done
-      RMOD_PKGS=( $(printf '%s\n' "${RMOD_PKGS[@]}" | "${grep_cmd[@]}" || :) )
-      info "final reverse dependencies that will be rebuilt: ${RMOD_PKGS[*]}"
-      FORCE_LOCAL_BUILD_PKGS+=( "${RMOD_PKGS[@]}" )
-    fi
-  fi
-fi # end FLAGS_withrevdeps
-
-if [[ ${#FORCE_LOCAL_BUILD_PKGS[@]} -gt 0 ]]; then
-  EMERGE_FLAGS+=(
-    --reinstall-atoms="${FORCE_LOCAL_BUILD_PKGS[*]}"
-    --usepkg-exclude="${FORCE_LOCAL_BUILD_PKGS[*]}"
-  )
-fi
-
-# A list of critical system packages that should never be incidentally
-# reinstalled as a side effect of build_packages. All packages in this list
-# are special cased to prefer matching installed versions, overriding the
-# typical logic of upgrading to the newest available version.
-#
-# This list can't include any package that gets installed to a board!
-# Packages such as LLVM or binutils must not be in this list as the normal
-# rebuild logic must still apply to them for board targets.
-#
-# TODO(crbug/1050752): Remove this list and the corresponding arguments
-# to `emerge` below once we figure out how to exclude toolchain packages from
-# being upgraded transitively via BDEPEND relations.
-CRITICAL_SDK_PACKAGES=(
-  "dev-lang/rust"
-  "dev-lang/go"
-  "sys-libs/glibc"
-  "sys-devel/gcc"
-)
-
-info "Merging board packages now"
-(
-  # Support goma on bots. This has to run in subshell, otherwise EXIT trap
-  # handler is overwritten.
-  if [[ "${FLAGS_run_goma}" -eq "${FLAGS_TRUE}" ]]; then
-    info "Starting goma compiler_proxy."
-    goma_ctl="${GOMA_DIR:-${HOME}/goma}/goma_ctl.py"
-    "${goma_ctl}" restart
-    trap "'${goma_ctl}' stop" EXIT
-  fi
-
-  info_run sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" "${PACKAGES[@]}" \
-    --useoldpkg-atoms="${CRITICAL_SDK_PACKAGES[*]}" \
-    --rebuild-exclude="${CRITICAL_SDK_PACKAGES[*]}"
-)
-
-echo "Builds complete"
-
-if [[ ${FLAGS_withdebugsymbols} -eq ${FLAGS_TRUE} ]]; then
-  info "fetching the debug symbols"
-  info_run sudo -E "${CHROMITE_BIN}/cros_install_debug_syms" \
-    "--board=${FLAGS_board}" "--all"
-fi
-
-command_completed
-echo "Done"
+new_script="build_packages"
+warn "$0: This script is deprecated and will be removed."
+warn "All users must migrate to ${new_script} in chromite/bin."
+warn "You can simply change all references of $0 to \`${new_script}\`" \
+  "from \$PATH (in chromite/bin/)."
+warn "This old script will be removed by July 2022."
+warn "If you have questions or found code that needs updating, please" \
+  "contact chromium-os-dev@, or file a bug at go/cros-build-bug."
+exec "${CHROMITE_BIN}/${new_script}" "$@"
diff --git a/build_packages.sh b/build_packages.sh
new file mode 100644
index 0000000..6cd8c77
--- /dev/null
+++ b/build_packages.sh
@@ -0,0 +1,556 @@
+#!/bin/bash
+
+# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# This script is being deprecated and moved to chromite/ by 2022-06-30.
+# Do not add any references to this script.
+# Please reach out if you have any questions.
+
+. "$(dirname "$0")/common.sh" || exit 1
+
+if [[ "$1" != "--script-is-run-only-by-chromite-and-not-users" ]]; then
+  die_notrace 'This script must not be run by users.' \
+    'Please run `build_packages` from $PATH (in chromite/bin/) instead.'
+fi
+# Discard the magic marker flag.
+shift
+
+# Script must run inside the chroot
+restart_in_chroot_if_needed "$@"
+
+assert_not_root_user
+
+# Developer-visible flags.
+DEFINE_string board "${DEFAULT_BOARD}" \
+  "The board to build packages for."
+DEFINE_boolean chrome "${FLAGS_FALSE}" \
+  "Ensure chrome instead of chromium. Alias for --internal --nouse_any_chrome."
+DEFINE_boolean usepkg "${FLAGS_TRUE}" \
+  "Use binary packages to bootstrap when possible."
+DEFINE_boolean usepkgonly "${FLAGS_FALSE}" \
+  "Only use binary packages to bootstrap; abort if any are missing."
+DEFINE_boolean workon "${FLAGS_TRUE}" \
+  "Force-build workon packages."
+DEFINE_boolean showoutput "${FLAGS_FALSE}" \
+  "Show all output from parallel_emerge."
+DEFINE_boolean withautotest "${FLAGS_TRUE}" \
+  "Build autotest client code."
+DEFINE_boolean withdebugsymbols "${FLAGS_FALSE}" \
+  "Install the debug symbols for all packages"
+DEFINE_boolean withrevdeps "${FLAGS_TRUE}" \
+  "Calculate reverse dependencies on changed ebuilds."
+DEFINE_boolean autosetgov "${FLAGS_FALSE}" \
+  "Automatically set cpu governor to 'performance'."
+DEFINE_boolean autosetgov_sticky "${FLAGS_FALSE}" \
+  "Remember --autosetgov setting for future runs."
+DEFINE_boolean use_any_chrome "${FLAGS_TRUE}" \
+  "Use any Chrome prebuilt available, even if the prebuilt doesn't match exactly."
+DEFINE_boolean cleanbuild "${FLAGS_FALSE}" \
+  "Perform a clean build; delete sysroot if it exists before building."
+DEFINE_boolean internal "${FLAGS_FALSE}" \
+  "Build the internal version of chrome (set the chrome_internal USE flag)."
+DEFINE_boolean pretend "${FLAGS_FALSE}" \
+  "Don't build packages, just display which packages would have been installed."
+
+# The --board_root flag specifies the environment variables ROOT and PKGDIR.
+# This allows fetching and emerging of all packages to specified board_root.
+# Note that --board_root will setup the board normally in /build/$BOARD, if it's
+# not setup yet. It also expects the toolchain to already be installed in the
+# board_root. --usepkgonly and --norebuild are required, because building is not
+# supported when board_root is set.
+# enforce this)."
+DEFINE_string board_root "" \
+  "Emerge packages to board_root."
+
+FLAGS_HELP="usage: $(basename $0) [flags] [packages]
+
+build_packages updates the set of binary packages needed by Chrome OS. It will
+cross compile all packages that have been updated into the given target's root
+and build binary packages as a side-effect. The output packages will be picked
+up by the build_image script to put together a bootable Chrome OS image.
+
+If [packages] are specified, only build those specific packages (and any
+dependencies they might need).
+
+For the fastest builds, use --nowithautotest --noworkon.
+"
+
+# The following options are advanced options, only available to those willing
+# to read the source code. They are not shown in help output, since they are
+# not needed for the typical developer workflow.
+DEFINE_string accept_licenses "" \
+  "Licenses to append to the accept list."
+DEFINE_boolean eclean "${FLAGS_TRUE}" \
+  "Run eclean to delete old binpkgs."
+DEFINE_integer jobs -1 \
+  "How many packages to build in parallel at maximum."
+DEFINE_boolean norebuild "${FLAGS_FALSE}" \
+  "Don't automatically rebuild dependencies."
+DEFINE_boolean skip_chroot_upgrade "${FLAGS_FALSE}" \
+  "Don't run the chroot upgrade automatically; use with care."
+DEFINE_boolean skip_setup_board "${FLAGS_FALSE}" \
+  "Don't run setup_board. Implies skip_chroot_upgrade and" \
+  "skip_toolchain_update."
+DEFINE_boolean skip_toolchain_update "${FLAGS_FALSE}" \
+  "Don't update toolchain automatically."
+DEFINE_boolean withdev "${FLAGS_TRUE}" \
+  "Build useful developer friendly utilities."
+DEFINE_boolean withdebug "${FLAGS_TRUE}" \
+  "Build debug versions of Chromium-OS-specific packages."
+DEFINE_boolean withfactory "${FLAGS_TRUE}" \
+  "Build factory installer."
+DEFINE_boolean withtest "${FLAGS_TRUE}" \
+  "Build packages required for testing."
+DEFINE_boolean expandedbinhosts "${FLAGS_TRUE}" \
+  "Allow expanded binhost inheritance."
+
+# The --reuse_pkgs_from_local_boards flag tells Portage to share binary
+# packages between boards that are built locally, so that the total time
+# required to build several boards is reduced. This flag is only useful
+# when you are not able to use remote binary packages, since remote binary
+# packages are usually more up to date than anything you have locally.
+DEFINE_boolean reuse_pkgs_from_local_boards "${FLAGS_FALSE}" \
+  "Bootstrap from local packages instead of remote packages."
+
+# --run_goma option is designed to be used on bots.
+# If you're trying to build pacakges with goma in your local dev env, this is
+# *not* the option you're looking for. Please see comments below.
+# This option; 1) starts goma, 2) builds packages (expecting that goma is
+# used), then 3) stops goma explicitly.
+# 3) is a request from the goma team, so that stats/logs can be taken.
+# Note: GOMA_DIR and GOMA_SERVICE_ACCOUNT_JSON_FILE are expected to be passed
+# via env var.
+#
+# In local dev env cases, compiler_proxy is expected to keep running.
+# In such a case;
+#   $ python ${GOMA_DIR}/goma_ctl.py ensure_start
+#   $ ./build_packages (... and options without --run_goma ...)
+# is an expected commandline sequence. If you set --run_goma flag while
+# compiler_proxy is already running, the existing compiler_proxy will be
+# stopped.
+DEFINE_boolean run_goma "${FLAGS_FALSE}" \
+  "If set to true, (re)starts goma, builds packages, and then stops goma."
+
+# This option is for building chrome remotely.
+#1) starts reproxy 2) builds chrome with reproxy and 3) stops reproxy so
+# logs/stats can be collected.
+# Note: RECLIENT_DIR and REPROXY_CFG are expected to be passed via env var.
+DEFINE_boolean run_remoteexec "${FLAGS_FALSE}" \
+  "If set to true, starts RBE reproxy, builds packages, and then stops reproxy."
+
+# Parse command line
+FLAGS "$@" || exit 1
+eval set -- "${FLAGS_ARGV}"
+
+# Die on any errors.
+switch_to_strict_mode
+
+# Chrome packages that need to be treated the same. These are the chrome and
+# chrome follow-on packages that share the same version as chrome and are
+# updated in lock step.
+CHROME_PACKAGES=(
+  "chromeos-base/chromeos-chrome"
+  "chromeos-base/chrome-icu"
+)
+
+# Alias/implied flag translations.
+if [[ "${FLAGS_chrome}" -eq "${FLAGS_TRUE}" ]]; then
+  FLAGS_internal="${FLAGS_TRUE}"
+  FLAGS_use_any_chrome="${FLAGS_FALSE}"
+fi
+
+if [[ "${FLAGS_internal}" -eq "${FLAGS_TRUE}" ]]; then
+  export USE="${USE} chrome_internal"
+fi
+
+# Right now build_packages has to be run from scripts/
+. ${SRC_ROOT}/third_party/chromiumos-overlay/chromeos/config/chromeos_version.sh
+
+# On some systems, powersave can take a long time to ramp up.  Inform the user
+# so they can get faster builds.  https://crbug.com/1008932
+CHROMITE_CONFIG_DIR=$(
+  python -c 'from chromite.lib.chromite_config import DIR; print(DIR)')
+CONFIG_AUTOSETGOV="${CHROMITE_CONFIG_DIR}/autosetgov"
+if [[ "${FLAGS_autosetgov_sticky}" -eq "${FLAGS_TRUE}" ]]; then
+  mkdir -p "${CHROMITE_CONFIG_DIR}"
+  if [[ "${FLAGS_autosetgov}" -eq "${FLAGS_TRUE}" ]]; then
+    info "Future runs of build_packages will *always* use --autosetgov"
+    echo "# Delete this file to turn off automatic build_packages" \
+      "--autosetgov." >"${CONFIG_AUTOSETGOV}"
+  else
+    info "Future runs of build_packages will respect --autosetgov"
+    rm -f "${CONFIG_AUTOSETGOV}"
+  fi
+fi
+if [[ -e "${CONFIG_AUTOSETGOV}" ]]; then
+  FLAGS_autosetgov="${FLAGS_TRUE}"
+fi
+# Make sure we can actually support "performance".
+if grep -qs performance \
+     /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors; then
+  curr_gov=$(sort -u /sys/devices/system/cpu/cpufreq/policy*/scaling_governor)
+  if [[ "${curr_gov}" != "performance" ]]; then
+    if [[ "${FLAGS_autosetgov}" -eq "${FLAGS_TRUE}" ]]; then
+      if [[ $(echo "${curr_gov}" | wc -l) -gt 1 ]]; then
+        warn "Too many active CPU governors; refusing to use 'performance'."
+      else
+        info "Temporarily setting cpu governor to 'performance'"
+        trap "sudo cpupower -c all frequency-set -g powersave >&/dev/null" EXIT
+        sudo cpupower -c all frequency-set -g performance >&/dev/null
+      fi
+    elif [[ "${curr_gov}" == "powersave" ]]; then
+      warn "Current CPU governor set to 'powersave' which can slow down builds."
+      warn "Use --autosetgov to automatically (and temporarily) switch to" \
+        "'performance'."
+    fi
+  fi
+fi
+
+if [[ -z "${FLAGS_board}" ]]; then
+  echo "Error: --board is required."
+  exit 1
+fi
+
+BOARD_ROOT="${FLAGS_board_root:-/build/${FLAGS_board}}"
+
+# Skip revdeps when we don't already have a built sysroot.
+if [[ "${FLAGS_cleanbuild}" -eq "${FLAGS_TRUE}" || ! -d "${BOARD_ROOT}" ]]; then
+  SKIP_REVDEPS="${FLAGS_TRUE}"
+else
+  SKIP_REVDEPS="${FLAGS_FALSE}"
+fi
+
+if [[ "${FLAGS_skip_setup_board}" -eq "${FLAGS_FALSE}" ]]; then
+  # Before we can run any tools, we need to update chroot or setup_board.
+  UPDATE_ARGS=()
+  if [[ -n ${FLAGS_accept_licenses} ]]; then
+    UPDATE_ARGS+=( --accept-licenses "${FLAGS_accept_licenses}" )
+  fi
+  if [ "${FLAGS_usepkg}" -eq "${FLAGS_TRUE}" ]; then
+    UPDATE_ARGS+=( --usepkg )
+  else
+    UPDATE_ARGS+=( --nousepkg )
+  fi
+  if [[ "${FLAGS_jobs}" -ne -1 ]]; then
+    UPDATE_ARGS+=( --jobs=${FLAGS_jobs} )
+  fi
+  if [ "${FLAGS_reuse_pkgs_from_local_boards}" -eq "${FLAGS_TRUE}" ]; then
+    UPDATE_ARGS+=( --reuse-pkgs-from-local-boards )
+  fi
+  if [ "${FLAGS_skip_toolchain_update}" -eq "${FLAGS_TRUE}" ]; then
+    UPDATE_ARGS+=( --skip-toolchain-update )
+  fi
+  if [ "${FLAGS_skip_chroot_upgrade}" -eq "${FLAGS_TRUE}" ]; then
+    UPDATE_ARGS+=( --skip-chroot-upgrade )
+  fi
+  if [[ -n ${FLAGS_board_root} ]]; then
+    UPDATE_ARGS+=( --board-root "${FLAGS_board_root}" )
+  fi
+  if [ "${FLAGS_cleanbuild}" -eq "${FLAGS_TRUE}" ]; then
+    UPDATE_ARGS+=( --force )
+  fi
+  if [[ "${FLAGS_expandedbinhosts}" -eq "${FLAGS_FALSE}" ]]; then
+    UPDATE_ARGS+=( --fewer-binhosts )
+  fi
+
+  setup_board --quiet --board=${FLAGS_board} "${UPDATE_ARGS[@]}"
+fi
+
+sudo_clear_shadow_locks "${BOARD_ROOT}"
+PORTAGE_BINHOST=$(portageq-${FLAGS_board} envvar 'PORTAGE_BINHOST')
+info "PORTAGE_BINHOST: ${PORTAGE_BINHOST}"
+
+
+# Setup all the emerge command/flags.
+EMERGE_FLAGS=( -uDNv --backtrack=30 --newrepo --with-test-deps y )
+
+EMERGE_CMD=(
+  "${CHROMITE_BIN}/parallel_emerge"
+  --board=${FLAGS_board}
+)
+
+if [[ "${FLAGS_use_any_chrome}" -eq "${FLAGS_TRUE}" ]]; then
+  for pkg in "${CHROME_PACKAGES[@]}"; do
+    EMERGE_CMD+=( "--force-remote-binary=${pkg}" )
+  done
+fi
+
+EMERGE_CMD+=( ${EXTRA_BOARD_FLAGS} )
+
+if [[ "${FLAGS_pretend}" -eq "${FLAGS_TRUE}" ]]; then
+  EMERGE_FLAGS+=( "--pretend" )
+fi
+
+if [[ "${FLAGS_usepkg}" -eq "${FLAGS_TRUE}" ||
+      "${FLAGS_reuse_pkgs_from_local_boards}" -eq "${FLAGS_TRUE}" ||
+      "${FLAGS_usepkgonly}" -eq "${FLAGS_TRUE}" ]]; then
+  # Use binary packages. Include all build-time dependencies,
+  # so as to avoid unnecessary differences between source
+  # and binary builds.
+  EMERGE_FLAGS+=( --getbinpkg --with-bdeps y )
+  if [[ ${FLAGS_usepkgonly} -eq ${FLAGS_TRUE} ]]; then
+    EMERGE_FLAGS+=( --usepkgonly )
+  else
+    EMERGE_FLAGS+=( --usepkg )
+  fi
+fi
+
+if [[ "${FLAGS_jobs}" -ne -1 ]]; then
+  EMERGE_FLAGS+=( --jobs=${FLAGS_jobs} )
+fi
+
+if [[ "${FLAGS_norebuild}" -eq "${FLAGS_FALSE}" ]]; then
+  EMERGE_FLAGS+=( --rebuild-if-new-rev )
+fi
+if [[ "${FLAGS_showoutput}" -eq "${FLAGS_TRUE}" ]]; then
+  EMERGE_FLAGS+=( --show-output )
+fi
+
+if [[ "${FLAGS_withdebug}" -eq "${FLAGS_FALSE}" ]]; then
+  export USE="${USE} -cros-debug"
+fi
+
+# Figure out which packages we should be building.
+PACKAGES=( "$@" )
+FORCE_LOCAL_BUILD_PKGS=()
+if [[ $# -eq 0 ]]; then
+  PACKAGES=( virtual/target-os )
+  if [[ "${FLAGS_withdev}" -eq "${FLAGS_TRUE}" ]]; then
+    PACKAGES+=( virtual/target-os-dev )
+  fi
+  if [[ "${FLAGS_withfactory}" -eq "${FLAGS_TRUE}" ]]; then
+    PACKAGES+=( virtual/target-os-factory )
+    PACKAGES+=( virtual/target-os-factory-shim )
+  fi
+  if [[ "${FLAGS_withtest}" -eq "${FLAGS_TRUE}" ]]; then
+    PACKAGES+=( virtual/target-os-test )
+    # chromeos-ssh-testkeys may generate ssh keys if the right USE flag is set.
+    # We force rebuilding this package from source every time, so that
+    # consecutive builds don't share ssh keys.
+    FORCE_LOCAL_BUILD_PKGS+=( chromeos-base/chromeos-ssh-testkeys )
+  fi
+  if [[ "${FLAGS_withautotest}" -eq "${FLAGS_TRUE}" ]]; then
+    PACKAGES+=( chromeos-base/autotest-all )
+  fi
+fi
+
+info "Rebuilding Portage cache"
+# Before running any emerge operations, regenerate the Portage dependency cache
+# in parallel.
+info_run "${EMERGE_CMD[@]}" --regen --quiet
+
+# Clean out any stale binpkgs we've accumulated. This is done immediately after
+# regenerating the cache in case ebuilds have been removed (e.g. from a revert).
+if [[ "${FLAGS_eclean}" -eq "${FLAGS_TRUE}" ]]; then
+  info "Cleaning stale binpkgs"
+  get_eclean_exclusions | "eclean-${FLAGS_board}" -e /dev/stdin packages
+fi
+
+# Verify that all packages can be emerged from scratch, without any
+# backtracking. Only print the output if this step fails.
+info "Checking package dependencies are correct: ${PACKAGES[*]}"
+if ! OUTPUT=$(emerge-${FLAGS_board} -pe --backtrack=0 \
+              "${PACKAGES[@]}" 2>&1); then
+  printf "%s\n" "${OUTPUT}"
+  die_notrace "emerge detected broken ebuilds. See error message above."
+fi
+
+# Build cros_workon packages when they are changed.
+CROS_WORKON_PKGS=()
+if [ "${FLAGS_workon}" -eq "${FLAGS_TRUE}" ]; then
+  LIST_MODIFIED_PACKAGES="${CHROMITE_BIN}/cros_list_modified_packages"
+  MODIFIED_PACKAGES=( $("${LIST_MODIFIED_PACKAGES}" --board=${FLAGS_board}) )
+  info "cros_workon modified packages '${MODIFIED_PACKAGES[*]}' detected"
+  CROS_WORKON_PKGS+=( "${MODIFIED_PACKAGES[@]}" )
+
+  # TODO(anush): Make chrome a fake cros-workon package.
+  if [[ -n "${CHROME_ORIGIN}" ]]; then
+    CROS_WORKON_PKGS+=( "${CHROME_PACKAGES[@]}" )
+  fi
+fi
+
+# cros_workon packages always have to be rebuilt.
+FORCE_LOCAL_BUILD_PKGS+=( "${CROS_WORKON_PKGS[@]}" )
+
+# Any package that directly depends on an active cros_workon package also needs
+# to be rebuilt in order to be correctly built against the current set of
+# changes a user may have made to the cros_workon package.
+if [[ ${#CROS_WORKON_PKGS[@]} -gt 0 ]]; then
+  # Collect all installed packages that depend on active cros_workon packages.
+  WORKON_PKG_CONSUMERS=()
+  mapfile -t WORKON_PKG_CONSUMERS < <( \
+    equery-${FLAGS_board} -q depends "${CROS_WORKON_PKGS[@]}" | \
+    sort -u | \
+    grep -Ev "^\s*$" )
+
+  # Transform this list of packages with versions in to a list of just
+  # $CATEGORY/$NAME entries, since we don't want to pass packages with explicit
+  # version numbers as arguments to `emerge`.
+  if [[ ${#WORKON_PKG_CONSUMERS[@]} -gt 0 ]]; then
+    WORKON_REBUILD_PKGS=()
+    mapfile -t WORKON_REBUILD_PKGS < <( \
+      equery-${FLAGS_board} list -p -o --format='$category/$name' \
+        "${WORKON_PKG_CONSUMERS[@]}" | sort -u )
+
+    info "The following packages depend directly on an active" \
+      "cros_workon package and will be rebuilt: ${WORKON_REBUILD_PKGS[*]}"
+
+    FORCE_LOCAL_BUILD_PKGS+=( "${WORKON_REBUILD_PKGS[@]}" )
+  fi
+fi
+
+if [[ -n "${FLAGS_board_root}" ]]; then
+  export ROOT="${FLAGS_board_root}"
+  export PORTAGE_CONFIGROOT="${ROOT}"
+  export SYSROOT="${ROOT}"
+  export PKGDIR="${ROOT}"/packages
+fi
+
+# Temporarily modify the emerge flags so we can calculate the revdeps
+# on the modified packages.
+if [[ "${FLAGS_withrevdeps}" -eq "${FLAGS_TRUE}" &&
+      "${SKIP_REVDEPS}" -eq "${FLAGS_FALSE}" ]]; then
+  info "starting reverse dependency calculations ..."
+  SIM_EMERGE_FLAGS=( "${EMERGE_FLAGS[@]}" --pretend --columns )
+
+  if [[ ${#PACKAGES[@]} -gt 0 ]]; then
+    SIM_EMERGE_FLAGS+=(
+      --reinstall-atoms="${PACKAGES[*]}"
+      --usepkg-exclude="${PACKAGES[*]}"
+    )
+  fi
+
+  # cros-workon packages are always going to be force reinstalled, so we add
+  # the forced reinstall behavior to the modified package calculation. This is
+  # necessary to include when a user has already installed a 9999 ebuild and is
+  # now reinstalling that package with additional local changes, because
+  # otherwise the modified package calculation would not see that a 'new'
+  # package is being installed.
+  if [[ ${#CROS_WORKON_PKGS[@]} -gt 0 ]]; then
+    SIM_EMERGE_FLAGS+=(
+      --reinstall-atoms="${CROS_WORKON_PKGS[*]}"
+      --usepkg-exclude="${CROS_WORKON_PKGS[*]}"
+    )
+  fi
+
+  # Calculate only the ebuild changes from the emerge simulation ignoring
+  # the virtual packages and the forced rebuild of autotest-all package.
+  # The lines of the following block do the following operations:
+  # 1. Do a pretend `emerge` command to get a list of what would be built.
+  # 2. Filter to only packages that will be installed to the board sysroot.
+  # 3. Filter to only packages that would be built from source and rewrite the
+  #    line from Portage's full output to only $CATEGORY/$PACKAGE
+  # 4. Filter the list of packages to a heuristic set of packages known to have
+  #    incorrectly specified dependencies.
+  # 5. Sort the output and remove any duplicate entries.
+  BASE_INSTALL_PKGS=( $( \
+    sudo -E "${EMERGE_CMD[@]}" "${SIM_EMERGE_FLAGS[@]}" "${PACKAGES[@]}" | \
+    grep -e 'to /build/' | \
+    sed -n -E '/^\[ebuild /{s:^[^]]+\] +::;s: .*::;p}' | \
+    grep -E '/(coreboot-private-files.*|tast-build-deps)$' | \
+    sort -u ) )
+
+  MOD_PKGS=()
+  if [[ "${#BASE_INSTALL_PKGS[@]}" -gt 0 ]]; then
+    info "Forced rebuild packages detected: ${BASE_INSTALL_PKGS[*]}."
+    # Convert specific versions into base package names
+    MOD_PKGS+=( $(\
+    equery-${FLAGS_board} list -p -o --format='$category/$name' \
+      "${BASE_INSTALL_PKGS[@]}" | sort -u ) )
+    # Remove Chrome as rebuilding it is expensive and almost never makes sense.
+    # Ignore grep exit status in case chromeos-chrome is the only package.
+    grep_cmd=( grep -v )
+    for pkg in "${CHROME_PACKAGES[@]}"; do
+      grep_cmd+=( -e "${pkg}" )
+    done
+    MOD_PKGS=( $(printf '%s\n' "${MOD_PKGS[@]}" | "${grep_cmd[@]}" || :) )
+  fi
+
+  FORCE_LOCAL_BUILD_PKGS+=( "${MOD_PKGS[@]}" )
+
+  if [[ "${#MOD_PKGS[@]}" -gt 0 ]]; then
+    info "calculating reverse dependencies on packages: ${MOD_PKGS[*]}"
+    REV_DEPS=( $(\
+      equery-${FLAGS_board} -q depends --indirect "${MOD_PKGS[@]}" |\
+      awk '{print $1}' | grep -v ^virtual/ | sort -u) )
+    if [[ "${#REV_DEPS[@]}" -gt 0 ]]; then
+      # Convert specific versions into base package names
+      RMOD_PKGS=( $(\
+        equery-${FLAGS_board} -q list -p -o --format='$category/$name' \
+        "${REV_DEPS[@]}" | sort -u ) )
+      # Remove Chrome as rebuilding it is expensive and almost never makes
+      # sense.  Ignore grep exit status in case chromeos-chrome is the only
+      # package.
+      grep_cmd=( grep -v )
+      for pkg in "${CHROME_PACKAGES[@]}"; do
+        grep_cmd+=( -e "${pkg}" )
+      done
+      RMOD_PKGS=( $(printf '%s\n' "${RMOD_PKGS[@]}" | "${grep_cmd[@]}" || :) )
+      info "final reverse dependencies that will be rebuilt: ${RMOD_PKGS[*]}"
+      FORCE_LOCAL_BUILD_PKGS+=( "${RMOD_PKGS[@]}" )
+    fi
+  fi
+fi # end FLAGS_withrevdeps
+
+if [[ ${#FORCE_LOCAL_BUILD_PKGS[@]} -gt 0 ]]; then
+  EMERGE_FLAGS+=(
+    --reinstall-atoms="${FORCE_LOCAL_BUILD_PKGS[*]}"
+    --usepkg-exclude="${FORCE_LOCAL_BUILD_PKGS[*]}"
+  )
+fi
+
+# A list of critical system packages that should never be incidentally
+# reinstalled as a side effect of build_packages. All packages in this list
+# are special cased to prefer matching installed versions, overriding the
+# typical logic of upgrading to the newest available version.
+#
+# This list can't include any package that gets installed to a board!
+# Packages such as LLVM or binutils must not be in this list as the normal
+# rebuild logic must still apply to them for board targets.
+#
+# TODO(crbug/1050752): Remove this list and the corresponding arguments
+# to `emerge` below once we figure out how to exclude toolchain packages from
+# being upgraded transitively via BDEPEND relations.
+CRITICAL_SDK_PACKAGES=(
+  "dev-lang/rust"
+  "dev-lang/go"
+  "sys-libs/glibc"
+  "sys-devel/gcc"
+)
+
+info "Merging board packages now"
+(
+
+  # Start reproxy for remote execution of building chrome.
+  if [[ "${FLAGS_run_remoteexec}" -eq "${FLAGS_TRUE}" ]]; then
+    info "Starting RBE reproxy."
+    bootstrap="${RECLIENT_DIR}/bootstrap --cfg=${REPROXY_CFG} \
+      --re_proxy=${RECLIENT_DIR}/reproxy"
+    ${bootstrap}
+    trap "${bootstrap} --shutdown" EXIT
+  # Support goma on bots. This has to run in subshell, otherwise EXIT trap
+  # handler is overwritten.
+  elif [[ "${FLAGS_run_goma}" -eq "${FLAGS_TRUE}" ]]; then
+    info "Starting goma compiler_proxy."
+    goma_ctl="${GOMA_DIR:-${HOME}/goma}/goma_ctl.py"
+    "${goma_ctl}" restart
+    trap "'${goma_ctl}' stop" EXIT
+  fi
+
+  info_run sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" "${PACKAGES[@]}" \
+    --useoldpkg-atoms="${CRITICAL_SDK_PACKAGES[*]}" \
+    --rebuild-exclude="${CRITICAL_SDK_PACKAGES[*]}"
+)
+
+echo "Builds complete"
+
+if [[ ${FLAGS_withdebugsymbols} -eq ${FLAGS_TRUE} ]]; then
+  info "fetching the debug symbols"
+  info_run sudo -E "${CHROMITE_BIN}/cros_install_debug_syms" \
+    "--board=${FLAGS_board}" "--all"
+fi
+
+command_completed
+echo "Done"
diff --git a/build_sdk_board b/build_sdk_board
index cb54c47..1074921 100755
--- a/build_sdk_board
+++ b/build_sdk_board
@@ -76,26 +76,8 @@
 for d in "${SCRIPTS_DIR}"/hooks/*; do
   cmds+=( "ln -sfT '${d}' '${BOARD_ROOT}/etc/portage/hooks/${d##*/}'" )
 done
-sudo_multi "${cmds[@]}"
 
-# Generating the standard configuration file (make.conf.board_setup) for the
-# sysroot.
-cros_sysroot_utils generate-config --sysroot="${BOARD_ROOT}" \
-  --board="${BOARD}" --out-file="${BOARD_SETUP}"
-
-# Generate wrappers for portage helpers (equery, portageq, emerge, etc...).
-# Those are used to generate make.conf.board.
-cros_sysroot_utils create-wrappers --sysroot="${BOARD_ROOT}" \
-  --friendlyname="${BOARD}"
-
-# Choose the default profile.
-if ! cros_choose_profile --profile "" \
-      --board-root "${BOARD_ROOT}" --board "${BOARD}"; then
-  sudo rm -rf --one-file-system "${BOARD_ROOT}"
-  die "Selecting profile failed, removing incomplete board directory!"
-fi
-
-cmds=(
+cmds+=(
   "ln -sf '${CHROMIUMOS_CONFIG}/make.conf.${BOARD}' \
     '${BOARD_ETC}/make.conf'"
   "cp -f '/etc/make.conf.host_setup' '${BOARD_ETC}/'"
@@ -104,7 +86,7 @@
   # See http://crosbug.com/14498
   "mkdir -p '${BOARD_ROOT}'{/usr,}/lib64"
   "ln -sfT lib64 '${BOARD_ROOT}/lib'"
-  "rm -r '${BOARD_ROOT}/usr/lib'"
+  "rm -rf '${BOARD_ROOT}/usr/lib'"
   "ln -sfT lib64 '${BOARD_ROOT}/usr/lib'"
 
   # Copying some files for bootstrapping empty chroot.
@@ -115,6 +97,23 @@
 )
 sudo_multi "${cmds[@]}"
 
+# Generating the standard configuration file (make.conf.board_setup) for the
+# sysroot.
+info_run cros_sysroot_utils generate-config --sysroot="${BOARD_ROOT}" \
+  --board="${BOARD}" --out-file="${BOARD_SETUP}"
+
+# Generate wrappers for portage helpers (equery, portageq, emerge, etc...).
+# Those are used to generate make.conf.board.
+info_run cros_sysroot_utils create-wrappers --sysroot="${BOARD_ROOT}" \
+  --friendlyname="${BOARD}"
+
+# Choose the default profile.
+if ! info_run cros_choose_profile --profile "" \
+      --board-root "${BOARD_ROOT}" --board "${BOARD}"; then
+  sudo rm -rf --one-file-system "${BOARD_ROOT}"
+  die "Selecting profile failed, removing incomplete board directory!"
+fi
+
 EMERGE_CMD="${CHROMITE_BIN}/parallel_emerge"
 TOOLCHAIN_PACKAGES=(
   $("${CHROMITE_BIN}/cros_setup_toolchains" --show-packages host)
@@ -140,7 +139,7 @@
 run_emerge --emptytree --with-bdeps=y \
   --exclude --verbose "${TOOLCHAIN_PACKAGES[*]}" \
   "${PACKAGES[@]}" virtual/target-sdk-nobdeps
-sudo eclean -d packages
+info_run sudo eclean -d packages
 
 # Next, install our rebuilt packages into our separate root.
 HOST_FLAGS="--root=$BOARD_ROOT --update --verbose --deep --root-deps"
@@ -152,7 +151,7 @@
 # build deps.
 run_emerge $HOST_FLAGS --with-bdeps=n --oneshot \
   virtual/target-sdk-nobdeps
-sudo cp -a "${PKGDIR}" $BOARD_ROOT/packages
+info_run sudo cp -a "${PKGDIR}" $BOARD_ROOT/packages
 
 # Copy our chroot version into the newly packaged chroot.
 sudo cp -a "${CHROOT_VERSION_FILE}" "${BOARD_ROOT}${CHROOT_VERSION_FILE}"
diff --git a/chroot_version_hooks.d/189_purge_pypy b/chroot_version_hooks.d/189_purge_pypy
new file mode 100644
index 0000000..127df1a
--- /dev/null
+++ b/chroot_version_hooks.d/189_purge_pypy
@@ -0,0 +1,7 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Force rebuild of pypy3 to ensure portage picks up changes that cause byte
+# compilation of pypy3 libs.
+sudo emerge --rage-clean pypy3 || :
diff --git a/chroot_version_hooks.d/190_make_conf_board_setup_cleanup b/chroot_version_hooks.d/190_make_conf_board_setup_cleanup
new file mode 100644
index 0000000..c573cc9
--- /dev/null
+++ b/chroot_version_hooks.d/190_make_conf_board_setup_cleanup
@@ -0,0 +1,7 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Remove vars that reference the amd64-host sysroot from
+# /etc/make.conf.board_setup for it to be correctly used in the SDK.
+sudo sed -E -i '/ROOT|PKG_CONFIG/d' /etc/make.conf.board_setup
diff --git a/chroot_version_hooks.d/191_bash_completion_cleanup b/chroot_version_hooks.d/191_bash_completion_cleanup
new file mode 100644
index 0000000..29cd3d1
--- /dev/null
+++ b/chroot_version_hooks.d/191_bash_completion_cleanup
@@ -0,0 +1,11 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# We moved the file.
+sed -i \
+  -e '/^# Set up bash autocompletion.$/d' \
+  -e '/^\. ~\/trunk\/src\/scripts\/bash_completion/d' \
+  -e '/^\. ~\/chromiumos\/src\/scripts\/bash_completion/d' \
+  -e '/^\. .*\/chromite\/sdk\/etc\/bash_completion.d\/cros/d' \
+  /home/*/.bashrc 2>/dev/null || :
diff --git a/chroot_version_hooks.d/192_cleanup_dev_rust b/chroot_version_hooks.d/192_cleanup_dev_rust
new file mode 100644
index 0000000..be40a67
--- /dev/null
+++ b/chroot_version_hooks.d/192_cleanup_dev_rust
@@ -0,0 +1,42 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Clean up rust packages which no longer have corresponding ebuilds
+#
+# This is achieved by:
+# * Running `eclean` to remove binary packages without a corresponding ebuild
+# * Running `equery l -b` to find ebuilds with no binary package
+# * Running `emerge -C` to remove those revisions.
+
+export CLEAN_DELAY=0
+
+do_clean() {
+  local suffix="$1"
+  local emerge_cmd=()
+  local args
+
+  if [[ -z "${suffix}" ]]; then
+    emerge_cmd+=( sudo )
+
+    qlist -IC ^cross- | sudo eclean -e /dev/stdin packages
+  else
+    "eclean${suffix}" packages
+  fi
+  emerge_cmd+=( "emerge${suffix}" )
+
+  args=( $("equery${suffix}" l -b --format='=$cpv' 'dev-rust/*' ) )
+  if [[ ${#args[@]} -eq 0 ]]; then
+    return
+  fi
+
+  "${emerge_cmd[@]}" -C "${args[@]}"
+}
+
+do_clean
+for board_root in /build/*; do
+  board_name=${board_root##*/}
+  if [[ -d "${board_root}/var/db/pkg/dev-rust" ]]; then
+    do_clean "-${board_name}"
+  fi
+done
diff --git a/chroot_version_hooks.d/193_package_keywords b/chroot_version_hooks.d/193_package_keywords
new file mode 100644
index 0000000..bc409cf
--- /dev/null
+++ b/chroot_version_hooks.d/193_package_keywords
@@ -0,0 +1,33 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Portage changed the file name.
+
+migrate() {
+  local root="$1"
+  local etc="${root}/etc/portage"
+
+  # If the old dir doesn't exist, nothing to migrate.
+  if [[ ! -d "${etc}/package.keywords" ]]; then
+    return 0
+  fi
+
+  # Clear possibly empty dir.
+  sudo rmdir "${etc}/package.keywords" 2>/dev/null || :
+
+  # Create the new dir.
+  sudo mkdir -p "${etc}/package.accept_keywords"
+
+  # Move the content.
+  sudo mv "${etc}"/package.keywords/* "${etc}"/package.accept_keywords
+
+  # Delete the new empty dir.
+  sudo rmdir "${etc}/package.keywords"
+}
+
+migrate / &
+for board in /build/*/; do
+  migrate "${board}" &
+done
+wait
diff --git a/chroot_version_hooks.d/194_argcomplete_cleanup b/chroot_version_hooks.d/194_argcomplete_cleanup
new file mode 100644
index 0000000..d641f5c
--- /dev/null
+++ b/chroot_version_hooks.d/194_argcomplete_cleanup
@@ -0,0 +1,12 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Remove file generated by the activate-global-python-argcomplete command.
+sudo rm -f \
+  /mnt/host/source/chromite/sdk/etc/bash_completion.d/python-argcomplete.sh
+
+# Cleanup command from .bash_profile.
+sed -i \
+  -e '/^activate-global-python-argcomplete/d' \
+  /home/*/.bash_profile 2>/dev/null || :
diff --git a/chroot_version_hooks.d/195_cros_bash_completion b/chroot_version_hooks.d/195_cros_bash_completion
new file mode 100644
index 0000000..e281e3c
--- /dev/null
+++ b/chroot_version_hooks.d/195_cros_bash_completion
@@ -0,0 +1,10 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# We moved the file.
+if [[ ! -L /etc/bash_completion.d/cros ]]; then
+  sudo ln -sf \
+    /mnt/host/source/chromite/sdk/etc/bash_completion.d/cros \
+    /etc/bash_completion.d/cros
+fi
diff --git a/chroot_version_hooks.d/196_cleanup_dev_rust b/chroot_version_hooks.d/196_cleanup_dev_rust
new file mode 120000
index 0000000..d880e2d
--- /dev/null
+++ b/chroot_version_hooks.d/196_cleanup_dev_rust
@@ -0,0 +1 @@
+192_cleanup_dev_rust
\ No newline at end of file
diff --git a/chroot_version_hooks.d/197_trunk_to_chromiumos b/chroot_version_hooks.d/197_trunk_to_chromiumos
new file mode 100644
index 0000000..edddd0a
--- /dev/null
+++ b/chroot_version_hooks.d/197_trunk_to_chromiumos
@@ -0,0 +1,22 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# We renamed the symlink.
+for old_link in /home/*/trunk; do
+  new_link="${old_link%/*}/chromiumos"
+  if [[ -L "${old_link}" && ! -L "${new_link}" ]]; then
+    if [[ -f "${new_link}" ]]; then
+      rm -f "${new_link}"
+    elif [[ -d "${new_link}" ]]; then
+      # Some devs have a little .cache state for unknown reason.  Delete the
+      # few known safe paths, but don't try to delete the whole tree.
+      rm -rf "${new_link}/.cache/common"
+      rmdir "${new_link}/.cache" 2>/dev/null
+      if ! rmdir "${new_link}"; then
+        echo "ERROR: ~/chromiumos exists inside your SDK when it should not."
+      fi
+    fi
+    ln -s /mnt/host/source "${new_link}"
+  fi
+done
diff --git a/chroot_version_hooks.d/198_binutils236_upgrade b/chroot_version_hooks.d/198_binutils236_upgrade
new file mode 120000
index 0000000..d519755
--- /dev/null
+++ b/chroot_version_hooks.d/198_binutils236_upgrade
@@ -0,0 +1 @@
+182_binutils235_upgrade
\ No newline at end of file
diff --git a/chroot_version_hooks.d/199_emerge_libunwind b/chroot_version_hooks.d/199_emerge_libunwind
new file mode 100644
index 0000000..6e069e0
--- /dev/null
+++ b/chroot_version_hooks.d/199_emerge_libunwind
@@ -0,0 +1,15 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Force all boards to re-emerge llvm-libunwind
+# b/210927982
+
+for board_root in /build/*; do
+  board_name=${board_root##*/}
+  if [[ -d "${board_root}/var/db/pkg" ]]; then
+    emerge-${board_name} -gq sys-libs/gcc-libs sys-libs/llvm-libunwind --nodeps
+  fi
+done
+
+echo "Completed installation of sys-libs/llvm-libunwind in board sysroots"
diff --git a/chroot_version_hooks.d/200_trunk_chroot_cmd b/chroot_version_hooks.d/200_trunk_chroot_cmd
new file mode 100644
index 0000000..d7c2ce1
--- /dev/null
+++ b/chroot_version_hooks.d/200_trunk_chroot_cmd
@@ -0,0 +1,6 @@
+# Copyright 2022 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# We renamed the symlink.
+sed -i '/CHROOT_CWD/s:/trunk/:/chromiumos/:' /home/*/.bash_profile
diff --git a/common.sh b/common.sh
index 9a935b0..1d3d623 100644
--- a/common.sh
+++ b/common.sh
@@ -191,7 +191,7 @@
 # happen.
 _user="${USER}"
 [[ ${USER} == "root" ]] && _user="${SUDO_USER}"
-_CHROOT_TRUNK_DIRS=( "/home/${_user}/trunk" /mnt/host/source )
+_CHROOT_TRUNK_DIRS=( "/home/${_user}/chromiumos" /mnt/host/source )
 _DEPOT_TOOLS_DIRS=( "/home/${_user}/depot_tools" /mnt/host/depot_tools )
 unset _user
 
@@ -398,7 +398,9 @@
   *.hxx
   *.proto
   */.keep*
+  /build/initramfs
   /build/libexec/tast
+  /build/manatee
   /build/rootfs/dlc
   /build/share
   /etc/init.d
diff --git a/create_remote_test_driver b/create_remote_test_driver
deleted file mode 100755
index 0b1abd7..0000000
--- a/create_remote_test_driver
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/bin/bash
-
-# Copyright 2020 The Chromium OS Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Populates a directory with everything necessary to build a remote test driver
-# container.
-
-# BuildAndCopyTastItems builds and copies all Tast related executables
-# and data to targets.
-BuildAndCopyTastItems() {
-    # Emerge tast related executables.
-    sudo emerge tast-cmd
-    sudo emerge tast-remote-tests-cros
-    local tast_dir="$1/tast"
-    local tast_bin_dir="${tast_dir}/bin"
-    # Copy tast related items.
-    mkdir -p "${tast_bin_dir}"
-    cp /usr/bin/tast "${tast_bin_dir}"
-    cp /usr/bin/tast_rtd "${tast_bin_dir}"
-    cp /usr/bin/remote_test_runner "${tast_bin_dir}"
-    cp -pdr /usr/libexec/tast/bundles "${tast_dir}"
-    cp -pdr /usr/share/tast/data "${tast_dir}"
-    cp -pdr /etc/tast/vars "${tast_dir}"
-    cp -pdr /home/"${USER}"/trunk/chromite/ssh_keys "${tast_dir}"
-}
-
-readonly script_dir="$(dirname "$(realpath -e "${BASH_SOURCE[0]}")")"
-. "${script_dir}/common.sh" || exit 1
-
-# Script must run inside the chroot
-assert_inside_chroot "$@"
-
-# Do not run as root
-assert_not_root_user
-
-DEFINE_string output_dir "" "Dir in which to put Dockerfile and dependencies"
-
-# Parse command line flags
-FLAGS "$@" || exit 1
-eval set -- "${FLAGS_ARGV}"
-
-# Only now can we die on error.  shflags functions leak non-zero error codes,
-# so will die prematurely if 'switch_to_strict_mode' is specified before now.
-switch_to_strict_mode
-
-output_dir="${FLAGS_output_dir}"
-if [[ -z "${FLAGS_output_dir}" ]]; then
-  info "No --output_dir provided. Using temp dir instead"
-  output_dir=$(mktemp -d)
-fi
-
-if [[ ! -d "${output_dir}" ]]; then
-  error "output_dir ${output_dir} must exist as a directory"
-  exit 1
-fi
-
-if [[ -n "$(ls -A "${output_dir}")" ]]; then
-  error "output_dir ${output_dir} must be empty"
-  exit 1
-fi
-
-# Write out a simple Dockerfile.
-cat > "${output_dir}/Dockerfile" <<- EOF
-FROM ubuntu:bionic
-WORKDIR /usr/src/rtd/
-COPY rtd/ .
-EOF
-
-# Create the remote test driver folder and copy test content into it.
-rtd_dir="${output_dir}/rtd"
-mkdir "${rtd_dir}"
-# Build and copy the tnull (fake) RTD.
-sudo emerge tnull
-cp /usr/bin/tnull "${rtd_dir}/"
-
-# tast and tauto entries will eventually go here.
-BuildAndCopyTastItems "${rtd_dir}"
-
-command_completed
-info "Done. Wrote output to ${output_dir}"
diff --git a/cros_workon_make b/cros_workon_make
index 8ddb90b..23684fd 100755
--- a/cros_workon_make
+++ b/cros_workon_make
@@ -94,7 +94,7 @@
 workpath="/build/${BOARD}/tmp/portage/${workpath}"
 
 # Export vars that the ebuild env needs from us.
-export SANDBOX_WRITE=~/trunk
+export SANDBOX_WRITE=~/chromiumos
 export CROS_WORKON_INPLACE=1
 export CROS_WORKON_MAKE_COMPILE_ARGS="$*"
 
diff --git a/hooks/install/check-upstart-scripts.sh b/hooks/install/check-upstart-scripts.sh
index 20637a4..f69cd3a 100755
--- a/hooks/install/check-upstart-scripts.sh
+++ b/hooks/install/check-upstart-scripts.sh
@@ -242,8 +242,8 @@
       eqawarn "${msg}"
     else
       eerror "${msg}"
-      return 1
     fi
+    return 1
   else
     if grep -q '^oom score *-1000' "${config}"; then
       eerror "${relconfig}: Use 'oom score never' instead."
@@ -267,13 +267,14 @@
     : $(( ret_oom += $? ))
   done
 
-  if [[ ${ret_oom} -eq 0 ]] && known_bad_oom; then
-    eqawarn "Please remove ${CATEGORY}/${PN} from known_bad_oom in $0."
-  fi
-
-  local ret=$(( ret_oom ))
-  if [[ ${ret} -ne 0 ]]; then
-    die "Init scripts have errors."
+  if [[ ${ret_oom} -eq 0 ]]; then
+    if known_bad_oom; then
+      eqawarn "Please remove ${CATEGORY}/${PN} from known_bad_oom in $0."
+    fi
+  else
+    if ! known_bad_oom; then
+      die "Init scripts have errors."
+    fi
   fi
 }
 
diff --git a/mod_for_test_scripts/340enableFwupdDummy b/mod_for_test_scripts/340enableFwupdDummy
index 1305888..8ca83de 100755
--- a/mod_for_test_scripts/340enableFwupdDummy
+++ b/mod_for_test_scripts/340enableFwupdDummy
@@ -8,6 +8,10 @@
   exit 0
 fi
 
+echo "Enabling verbose debug output for fwupd."
+
+sed -e 's/^\(VerboseDomains=\).*/\1*/' -i "${ROOT_FS_DIR}/etc/fwupd/daemon.conf"
+
 echo "Enabling dummy fwupd remote for tests."
 
 sed -e '/^DisabledPlugins=/s/^/#/' -i "${ROOT_FS_DIR}/etc/fwupd/daemon.conf"
diff --git a/mod_image_for_recovery.sh b/mod_image_for_recovery.sh
index 75b6586..ca076c3 100755
--- a/mod_image_for_recovery.sh
+++ b/mod_image_for_recovery.sh
@@ -76,7 +76,11 @@
 
 # Files to preserve from original stateful, if minimize_image is true.
 # If minimize_image is false, everything is always preserved.
-WHITELIST="vmlinuz_hd.vblock unencrypted/import_extensions"
+ALLOWLIST=(
+  "vmlinuz_hd.vblock"
+  "unencrypted/import_extensions"
+  "unencrypted/dlc-factory-images"
+)
 
 get_install_vblock() {
   # If it exists, we need to copy the vblock over to stateful
@@ -324,7 +328,7 @@
   sudo mkdir --mode=755 "${new_stateful_mnt}/unencrypted"
 
   # Copy over any files that need to be preserved.
-  for name in ${WHITELIST}; do
+  for name in "${ALLOWLIST[@]}"; do
     if [ -e "${old_stateful_mnt}/${name}" ]; then
       sudo cp -a "${old_stateful_mnt}/${name}" "${new_stateful_mnt}/${name}"
     fi
@@ -367,7 +371,7 @@
   sudo mount "${IMAGE_DEV}p${partition_num_state}" "${old_stateful_mnt}"
 
   # Print the minimum number of sectors needed.
-  find_sectors_needed "${old_stateful_mnt}" "${WHITELIST}"
+  find_sectors_needed "${old_stateful_mnt}" "${ALLOWLIST[*]}"
 
   # Cleanup everything.
   safe_umount "${old_stateful_mnt}"
diff --git a/sdk_lib/enter_chroot.sh b/sdk_lib/enter_chroot.sh
index c6a50a1..a1af4b2 100755
--- a/sdk_lib/enter_chroot.sh
+++ b/sdk_lib/enter_chroot.sh
@@ -28,6 +28,8 @@
 DEFINE_string cache_dir "" "Directory to use for caching."
 DEFINE_string goma_dir "" "Goma installed directory."
 DEFINE_string goma_client_json "" "Service account json file for goma."
+DEFINE_string reclient_dir "" "Reclient binaries installed directory."
+DEFINE_string reproxy_cfg_file "" "Config file for re-client's reproxy."
 DEFINE_string working_dir "" \
   "The working directory relative to ${CHROOT_TRUNK_DIR} for the command in \
 chroot, must start with '/' if set."
@@ -46,8 +48,8 @@
    $0 FOO=bar BAZ=bel
 
 If [-- command] is present, runs the command inside the chroot,
-after changing directory to /${SUDO_USER}/trunk/src/scripts.  Note that neither
-the command nor args should include single quotes.  For example:
+after changing directory to /${SUDO_USER}/chromiumos/src/scripts.  Note that
+neither the command nor args should include single quotes.  For example:
 
     $0 -- ./build_platform_packages.sh
 
@@ -205,8 +207,18 @@
     fi
   done
 
-  sed "/^.*\(${filter}\).*$/d" "${chroot_ssh_dir}/config.orig" | \
-    user_clobber "${chroot_ssh_dir}/config"
+  (
+  cat <<EOF
+### DO NOT EDIT ###
+# File is imported & synced from the copy outside of the SDK.
+# Modifications to this version will be lost!
+#
+# If you want directives to change behavior between inside & outside of the SDK:
+#   Match Exec "test -f /etc/cros_chroot_version"
+
+EOF
+  sed "/^.*\(${filter}\).*$/d" "${chroot_ssh_dir}/config.orig"
+  ) | user_clobber "${chroot_ssh_dir}/config"
 }
 
 copy_into_chroot_if_exists() {
@@ -411,6 +423,12 @@
       chmod 1777 "${run_shm}"
     fi
 
+    local run_lock="${FLAGS_chroot}/run/lock"
+    if [[ ! -d "${run_lock}" ]]; then
+      mkdir -p "${run_lock}"
+      chmod 1777 "${run_lock}"
+    fi
+
     # Do this early as it's slow and only needs basic mounts (above).
     generate_locales &
 
@@ -518,6 +536,16 @@
       setup_mount "${DEPOT_TOOLS}" --bind "${DEPOT_TOOLS_DIR}"
     fi
 
+    if [[ -n "${FLAGS_reclient_dir}" ]]; then
+      debug "Mounting re-client"
+      setup_mount "${FLAGS_reclient_dir}" --bind "/home/${SUDO_USER}/reclient"
+    fi
+
+    if [[ -n "${FLAGS_reproxy_cfg_file}" ]]; then
+      debug "Mounting reproxy config file."
+      setup_mount "${FLAGS_reproxy_cfg_file}" --bind "/home/${SUDO_USER}/reclient_cfgs/reproxy_chroot.cfg"
+    fi
+
     if [[ -n "${FLAGS_goma_dir}" ]]; then
       debug "Mounting goma"
       # $HOME/goma is the default directory for goma.
@@ -541,7 +569,7 @@
     # Mount additional directories as specified in .local_mounts file.
     local local_mounts="${FLAGS_trunk}/src/scripts/.local_mounts"
     if [[ -f ${local_mounts} ]]; then
-      info "Mounting local folders"
+      debug "Mounting local folders"
       # format: mount_source
       #      or mount_source mount_point
       #      or # comments
@@ -554,7 +582,7 @@
         : ${mount_point:=${mount_source}}
         debug "  mounting ${mount_source} on ${mount_point}"
         setup_mount "${mount_source}" "--bind" "${mount_point}"
-      done < <(sed -e 's:#.*::' "${local_mounts}")
+      done < <(sed -e 's:#.*::' "${local_mounts}" | xargs -0)
     fi
 
     if [[ -n "${FLAGS_chrome_root}" ]]; then
@@ -673,20 +701,6 @@
   ) 200>>"$LOCKFILE" || die "setup_env failed"
 }
 
-# Translate C.UTF-8 into something we support. Remove this when our glibc
-# starts supporting C.UTF-8. https://bugzilla.redhat.com/show_bug.cgi?id=902094
-for var in LANG \
-  LC_{ADDRESS,ALL,COLLATE,CTYPE,IDENTIFICATION,MEASUREMENT,MESSAGES} \
-  LC_{MONETARY,NAME,NUMERIC,PAPER,TELEPHONE,TIME}; do
-  if [[ ${!var} =~ C\.[Uu][Tt][Ff]-?8 ]]; then
-    if [[ ${var} == LC_COLLATE ]]; then
-      export LC_COLLATE=C
-    else
-      export ${var}=en_US.UTF-8
-    fi
-  fi
-done
-
 check_locale
 setup_env
 
@@ -696,7 +710,7 @@
   "EXTERNAL_TRUNK_PATH=${FLAGS_trunk}"
 
   # The default ~/.bash_profile in chroot will cd to $CHROOT_CWD instead of
-  # ~/trunk/src/script if that environment variable is set.
+  # ~/chromiumos/src/script if that environment variable is set.
   "CHROOT_CWD=${FLAGS_working_dir}"
 
   # We don't want to auto-update depot_tools inside of the SDK as we manage it.
diff --git a/update_bootloaders.sh b/update_bootloaders.sh
index 967dca5..9b49ae7 100755
--- a/update_bootloaders.sh
+++ b/update_bootloaders.sh
@@ -229,4 +229,8 @@
   fi
 fi
 
+if type board_update_bootloaders >&/dev/null; then
+  board_update_bootloaders "${BOARD_ROOT}" "${ESP_FS_DIR}"
+fi
+
 set +e
diff --git a/update_chroot b/update_chroot
index c85a7db..15e1158 100755
--- a/update_chroot
+++ b/update_chroot
@@ -139,9 +139,18 @@
 
 # Install post cross packages if binary pkgs are available.
 if [ "${FLAGS_usepkg}" -eq "${FLAGS_TRUE}" ]; then
+  # Use --usepkgonly to ensure that packages are not built from source.
+  EMERGE_FLAGS=( -uNv --with-bdeps=y --oneshot --getbinpkg --deep )
+  EMERGE_FLAGS+=( --usepkgonly --rebuilt-binaries=n )
+  EMERGE_FLAGS+=(
+    $("${CHROMITE_BIN}/cros_setup_toolchains" --show-packages host-post-cross)
+  )
+  sudo -E ${EMERGE_CMD} "${EMERGE_FLAGS[@]}"
+
   # Install nobdeps packages only when binary pkgs are available, since we don't
   # want to accidentally pull in build deps for a rebuild.
-  EMERGE_FLAGS=( -uNv --with-bdeps=n --oneshot --getbinpkg --deep --usepkgonly )
+  EMERGE_FLAGS=( -uNv --with-bdeps=n --oneshot --getbinpkg --deep )
+  EMERGE_FLAGS+=( --usepkgonly --rebuilt-binaries=n )
   info_run sudo -E "${EMERGE_CMD}" "${EMERGE_FLAGS[@]}" \
     virtual/target-sdk-nobdeps
 fi
@@ -161,4 +170,8 @@
   get_eclean_exclusions | sudo eclean -e /dev/stdin -d packages
 fi
 
+# Generate /usr/bin/remote_toolchain_inputs file for Reclient used by Chrome
+# for distributed builds, go/rbe/dev/x/reclient .
+info_run generate_reclient_inputs
+
 command_completed
diff --git a/update_kernel.sh b/update_kernel.sh
index 95999c5..a082e1a 100755
--- a/update_kernel.sh
+++ b/update_kernel.sh
@@ -6,7 +6,7 @@
 
 # Script to update the kernel on a live running ChromiumOS instance.
 
-SCRIPT_ROOT=$(dirname $(readlink -f "$0"))
+SCRIPT_ROOT="$(dirname "$(readlink -f "$0")")"
 . "${SCRIPT_ROOT}/common.sh" || exit 1
 . "${SCRIPT_ROOT}/remote_access.sh" || exit 1
 
@@ -19,19 +19,23 @@
 DEFINE_string rootoff "" "Override root offset"
 DEFINE_string rootfs "" "Override rootfs partition reported by target"
 DEFINE_string arch "" "Override architecture reported by target"
-DEFINE_boolean clean $FLAGS_FALSE "Remove old files before sending new files"
-DEFINE_boolean hv $FLAGS_TRUE "Use hypervisor kernel if available."
-DEFINE_boolean ignore_verity $FLAGS_FALSE "Update kernel even if system is using verity \
-(WARNING: likely to make the system unable to boot)"
-DEFINE_boolean reboot $FLAGS_TRUE "Reboot system after update"
-DEFINE_boolean vboot $FLAGS_TRUE "Update the vboot kernel"
-DEFINE_boolean syslinux $FLAGS_TRUE "Update the syslinux kernel (including /boot)"
-DEFINE_boolean bootonce $FLAGS_FALSE "Mark kernel partition as boot once"
-DEFINE_boolean remote_bootargs $FLAGS_FALSE "Use bootargs from running kernel on target"
-DEFINE_boolean firmware $FLAGS_FALSE "Also update firmwares (/lib/firmware)"
-DEFINE_boolean ab_update $FLAGS_FALSE "Update the kernel in the non-booting \
-kernel slot, similar to an AB update"
-DEFINE_string boot_command "" "Command to run on remote after update (after reboot if applicable)"
+DEFINE_boolean clean "${FLAGS_FALSE}" \
+  "Remove old files before sending new files"
+DEFINE_boolean hv "${FLAGS_TRUE}" "Use hypervisor kernel if available."
+DEFINE_boolean ignore_verity "${FLAGS_FALSE}" "Update kernel even if system \
+is using verity (WARNING: likely to make the system unable to boot)"
+DEFINE_boolean reboot "${FLAGS_TRUE}" "Reboot system after update"
+DEFINE_boolean vboot "${FLAGS_TRUE}" "Update the vboot kernel"
+DEFINE_boolean syslinux "${FLAGS_TRUE}" \
+  "Update the syslinux kernel (including /boot)"
+DEFINE_boolean bootonce "${FLAGS_FALSE}" "Mark kernel partition as boot once"
+DEFINE_boolean remote_bootargs "${FLAGS_FALSE}" \
+  "Use bootargs from running kernel on target"
+DEFINE_boolean firmware "${FLAGS_FALSE}" "Also update firmwares (/lib/firmware)"
+DEFINE_boolean ab_update "${FLAGS_FALSE}" \
+  "Update the kernel in the non-booting kernel slot, similar to an AB update"
+DEFINE_string boot_command "" \
+  "Command to run on remote after update (after reboot if applicable)"
 
 ORIG_ARGS=("$@")
 
@@ -77,11 +81,11 @@
 
 # Ask the target what the kernel partition is
 learn_partition_and_ro() {
-  ! remote_sh rootdev
+  remote_sh rootdev || die_notrace
   if [ "${REMOTE_OUT%%-*}" == "/dev/dm" ]; then
     remote_sh rootdev -s
     REMOTE_VERITY=${FLAGS_TRUE}
-    if [[ ${FLAGS_ignore_verity} -eq ${FLAGS_TRUE} ]]; then
+    if [[ "${FLAGS_ignore_verity}" -eq "${FLAGS_TRUE}" ]]; then
         warn "System is using verity: not updating firmware/modules"
     else
         warn "System is using verity: First remove rootfs verification using"
@@ -93,7 +97,7 @@
     REMOTE_VERITY=${FLAGS_FALSE}
     info "System is not using verity: updating firmware and modules"
   fi
-  if [[ ${FLAGS_ab_update} -eq ${FLAGS_TRUE} ]]; then
+  if [[ "${FLAGS_ab_update}" -eq "${FLAGS_TRUE}" ]]; then
     if [[ "${REMOTE_OUT}" == "${FLAGS_device}${PARTITION_NUM_ROOT_A}" ]]; then
       FLAGS_partition="${FLAGS_device}${PARTITION_NUM_KERN_B}"
       FLAGS_rootfs="${FLAGS_device}${PARTITION_NUM_ROOT_B}"
@@ -120,9 +124,9 @@
   if [ -z "${FLAGS_partition}" ]; then
     die_notrace "Partition required"
   fi
-  if [ ${REMOTE_VERITY} -eq ${FLAGS_TRUE} ]; then
+  if [[ "${REMOTE_VERITY}" -eq "${FLAGS_TRUE}" ]]; then
     info "Target reports kernel partition is ${FLAGS_partition}"
-    if [ ${FLAGS_vboot} -eq ${FLAGS_FALSE} ]; then
+    if [[ "${FLAGS_vboot}" -eq "${FLAGS_FALSE}" ]]; then
       die_notrace "Must update vboot when target is using verity"
     fi
   fi
@@ -140,7 +144,7 @@
     FLAGS_remote_bootargs=${FLAGS_TRUE}
   fi
 
-  if [ ${FLAGS_remote_bootargs} -eq ${FLAGS_TRUE} ] ; then
+  if [[ "${FLAGS_remote_bootargs}" -eq "${FLAGS_TRUE}" ]]; then
     info "Using remote bootargs"
     remote_sh dump_kernel_config "${FLAGS_partition}"
     printf '%s' "${REMOTE_OUT}"
@@ -169,8 +173,9 @@
   local bootloader_path
   local kernel_image
   local boot_path="/build/${FLAGS_board}"
-  local config_path="$(mktemp /tmp/config.txt.XXXXX)"
-  if [[ ${FLAGS_hv} -eq ${FLAGS_TRUE} && \
+  local config_path
+  config_path="$(mktemp /tmp/config.txt.XXXXX)"
+  if [[ "${FLAGS_hv}" -eq "${FLAGS_TRUE}" && \
         -d "${boot_path}/build/manatee/boot" ]]; then
     boot_path+="/build/manatee/boot"
   else
@@ -192,17 +197,40 @@
     bootloader_path="/lib64/bootstub/bootstub.efi"
   fi
   get_bootargs > "${config_path}"
-  vbutil_kernel --pack $TMP/new_kern.bin \
+  vbutil_kernel --pack "${TMP}"/new_kern.bin \
     --keyblock /usr/share/vboot/devkeys/kernel.keyblock \
     --signprivate /usr/share/vboot/devkeys/kernel_data_key.vbprivk \
     --version 1 \
-    --config ${config_path} \
+    --config "${config_path}" \
     --bootloader "${bootloader_path}" \
     --vmlinuz "${kernel_image}" \
     --arch "${FLAGS_arch}"
   rm "${config_path}"
 }
 
+check_buildid() {
+  local vmlinux="/build/${FLAGS_board}/usr/lib/debug/boot/vmlinux"
+  if [[ ! -f "${vmlinux}" ]]; then
+    warn "Can't find vmlinux. Skipping buildid check."
+    return
+  fi
+
+  llvm-objcopy -j.notes "${vmlinux}" -O binary "${TMP}/new_kern.notes"
+  if [[ ! -f "${TMP}/new_kern.notes" ]]; then
+    warn "Can't parse notes from vmlinux. Skipping buildid check."
+    return
+  fi
+  echo "/sys/kernel/notes" >> "${TMP}/copy_notes"
+  remote_rsync_from "${TMP}/copy_notes" "${TMP}/remote_kern.notes"
+  if [[ ! -f "${TMP}/remote_kern.notes" ]]; then
+    warn "Can't read notes from remote. Skipping buildid check."
+    return
+  fi
+
+  cmp "${TMP}/new_kern.notes" "${TMP}/remote_kern.notes" >/dev/null ||
+  error "BuildID differs. Update kernel failed."
+}
+
 copy_kernelmodules() {
   local basedir="$1" # rootfs directory (could be in /tmp) or empty string
   local modules_dir=/build/"${FLAGS_board}"/lib/modules/
@@ -223,8 +251,10 @@
 }
 
 check_kernelbuildtime() {
-  local version=$(readlink "/build/${FLAGS_board}/boot/vmlinuz" | cut -d- -f2-)
-  local build_dir="/build/${FLAGS_board}/lib/modules/${version}/build"
+  local version
+  local build_dir
+  version=$(readlink "/build/${FLAGS_board}/boot/vmlinuz" | cut -d- -f2-)
+  build_dir="/build/${FLAGS_board}/lib/modules/${version}/build"
   if [ "${build_dir}/Makefile" -nt "/build/${FLAGS_board}/boot/vmlinuz" ]; then
     warn "Your build directory has been built more recently than"
     warn "the installed kernel being updated to.  Did you forget to"
@@ -234,7 +264,7 @@
 
 mark_boot_once() {
   local idx=${FLAGS_partition##*[^0-9]}
-  remote_sh cgpt add -i ${idx} -S 0 -T 1 -P 15 ${FLAGS_device%p}
+  remote_sh cgpt add -i "${idx}" -S 0 -T 1 -P 15 "${FLAGS_device%p}"
 }
 
 update_syslinux_kernel() {
@@ -242,13 +272,16 @@
   # ARM does not have the syslinux directory, so skip it when the
   # partition is missing, the file system fails to mount, or the syslinux
   # vmlinuz target is missing.
-  remote_sh grep $(echo ${FLAGS_device}${PARTITION_NUM_EFI_SYSTEM} | cut -d/ -f3) /proc/partitions
-  if [ $(echo "$REMOTE_OUT" | wc -l) -eq 1 ]; then
-    remote_sh mkdir -p /tmp/${PARTITION_NUM_EFI_SYSTEM}
-    if remote_sh mount ${FLAGS_device}${PARTITION_NUM_EFI_SYSTEM} \
-                       /tmp/${PARTITION_NUM_EFI_SYSTEM}; then
+  remote_sh grep \
+    "$(echo "${FLAGS_device}${PARTITION_NUM_EFI_SYSTEM}" | cut -d/ -f3)" \
+    /proc/partitions
+  if [[ "$(echo "${REMOTE_OUT}" | wc -l)" -eq 1 ]]; then
+    remote_sh mkdir -p "/tmp/${PARTITION_NUM_EFI_SYSTEM}"
+    if remote_sh mount "${FLAGS_device}${PARTITION_NUM_EFI_SYSTEM}" \
+                       "/tmp/${PARTITION_NUM_EFI_SYSTEM}"; then
 
-      if [ "$FLAGS_partition" = "${FLAGS_device}${PARTITION_NUM_KERN_A}" ]; then
+      if [[ "${FLAGS_partition}" = \
+            "${FLAGS_device}${PARTITION_NUM_KERN_A}" ]]; then
         target="/tmp/${PARTITION_NUM_EFI_SYSTEM}/syslinux/vmlinuz.A"
       else
         target="/tmp/${PARTITION_NUM_EFI_SYSTEM}/syslinux/vmlinuz.B"
@@ -256,9 +289,9 @@
       remote_sh "test ! -f ${target} || \
                  cp ${basedir}/boot/vmlinuz ${target}"
 
-      remote_sh umount /tmp/${PARTITION_NUM_EFI_SYSTEM}
+      remote_sh umount "/tmp/${PARTITION_NUM_EFI_SYSTEM}"
     fi
-    remote_sh rmdir /tmp/${PARTITION_NUM_EFI_SYSTEM}
+    remote_sh rmdir "/tmp/${PARTITION_NUM_EFI_SYSTEM}"
   fi
 }
 
@@ -310,13 +343,13 @@
 
   check_kernelbuildtime
 
-  if [ ${FLAGS_vboot} -eq ${FLAGS_TRUE} ]; then
+  if [[ "${FLAGS_vboot}" -eq "${FLAGS_TRUE}" ]]; then
     make_kernelimage
   fi
 
-  if [[ ${REMOTE_VERITY} -eq ${FLAGS_FALSE} ]]; then
+  if [[ "${REMOTE_VERITY}" -eq "${FLAGS_FALSE}" ]]; then
     local remote_basedir
-    if [[ ${REMOTE_NEEDS_ROOTFS_MOUNTED} -eq ${FLAGS_TRUE} ]]; then
+    if [[ "${REMOTE_NEEDS_ROOTFS_MOUNTED}" -eq "${FLAGS_TRUE}" ]]; then
       remote_sh mktemp -d /tmp/rootfs_mounted.XXXXXX
       remote_basedir="${REMOTE_OUT}"
       remote_sh mount "${FLAGS_rootfs}" "${remote_basedir}"
@@ -353,14 +386,15 @@
     fi
   fi
 
-  if [ ${FLAGS_vboot} -eq ${FLAGS_TRUE} ]; then
+  if [[ "${FLAGS_vboot}" -eq "${FLAGS_TRUE}" ]]; then
     info "Copying vboot kernel image"
     copy_kernelimage
   else
     info "Skipping update of vboot (per request)"
   fi
 
-  if [ ${FLAGS_bootonce} -eq ${FLAGS_TRUE} ]; then
+  if [[ "${FLAGS_bootonce}" -eq "${FLAGS_TRUE}" || \
+        "${FLAGS_ab_update}" -eq "${FLAGS_TRUE}" ]]; then
     info "Marking kernel partition ${FLAGS_partition} as boot once"
     mark_boot_once
   fi
@@ -369,12 +403,16 @@
   # sync for safety to avoid random file system corruption.
   remote_sh sync
 
-  if [ ${FLAGS_reboot} -eq ${FLAGS_TRUE} ]; then
+  if [[ "${FLAGS_reboot}" -eq "${FLAGS_TRUE}" ]]; then
     remote_reboot
 
     remote_sh uname -r -v
     info "old kernel: ${old_kernel}"
     info "new kernel: ${REMOTE_OUT}"
+
+    if [[ "${FLAGS_vboot}" -eq "${FLAGS_TRUE}" ]]; then
+      check_buildid
+    fi
   else
     info "Not rebooting (per request)"
   fi