diff --git a/libwvdrmengine/apex/device/AndroidProducts.mk b/libwvdrmengine/apex/device/AndroidProducts.mk
new file mode 100644
index 00000000..ff2f217d
--- /dev/null
+++ b/libwvdrmengine/apex/device/AndroidProducts.mk
@@ -0,0 +1,2 @@
+PRODUCT_MAKEFILES := \
+	$(LOCAL_DIR)/widevine_generic.mk \
diff --git a/libwvdrmengine/apex/device/build.sh b/libwvdrmengine/apex/device/build.sh
new file mode 100755
index 00000000..eb9b2b79
--- /dev/null
+++ b/libwvdrmengine/apex/device/build.sh
@@ -0,0 +1,126 @@
+#!/bin/bash -eux
+#
+# Copyright (C) 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This script is used to build widevine apex bundle
+
+readonly -a ARCHS=(
+  "arm"
+  "arm64"
+  "arm64only"
+  "x86"
+  "x86_64"
+  "x86_64only"
+)
+
+
+function die() { format=$1; shift; printf >&2 "$format\n" $@; exit 1; }
+
+
+# $@: additional build targets
+# inputs: none
+# outputs: ${DIST_DIR}/${arch}/${apex}-base.zip
+function build_modules() {
+  # keep DIST_DIR to override for each arch
+  local dist_dir="${DIST_DIR}"
+  for arch in "${ARCHS[@]}"; do
+    # override DIST_DIR for each arch
+    DIST_DIR="${dist_dir}/${arch}" \
+    TARGET_PRODUCT="widevine_generic" \
+    TARGET_BASE_PRODUCT="build/target/product/module_${arch}.mk" \
+    build/soong/soong_ui.bash --make-mode "$@" \
+        ALWAYS_EMBED_NOTICES=true \
+        apps_only \
+        dist \
+        lint-check
+  done
+  # restore DIST_DIR
+  DIST_DIR="${dist_dir}"
+}
+
+
+# $1: apex
+# inputs: ${DIST_DIR}/${arch}/${apex}-base.zip
+# outputs: ${DIST_DIR}/${apex}.aab
+function build_bundle() {
+  local -r apex=$1
+
+  # collect base.zip files
+  local -a zips
+  for arch in "${ARCHS[@]}"; do
+    zips+=("${DIST_DIR}/${arch}/${apex}-base.zip")
+  done
+  local -ra zips
+
+  # extract bundle_config.json from one of zip files
+  unzip -o -d "${TMPDIR}/${apex}" "${zips[0]}" bundle_config.json
+
+  # merge base.zip files
+  local -r base_zip="${TMPDIR}/${apex}/base.zip"
+  ${MERGE_ZIPS} \
+    -ignore-duplicates \
+    -stripFile bundle_config.json \
+    "${base_zip}" \
+    "${zips[@]}"
+
+  # build bundle
+  ${BUNDLETOOL} build-bundle \
+    --overwrite \
+    --modules "${base_zip}" \
+    --config "${TMPDIR}/${apex}/bundle_config.json" \
+    --output "${DIST_DIR}/${apex}.aab"
+}
+
+
+# inputs: ${DIST_DIR}/${arch}/${apex}-base.zip
+# outputs: ${DIST_DIR}/${apex}.aab
+function build_bundles() {
+  for app in ${TARGET_BUILD_APPS}; do
+    build_bundle "${app}"
+  done
+}
+
+
+# inputs: ${DIST_DIR}/${apex}.aab
+# outputs: ${DIST_DIR}/dev_keys_signed/${apex}/${apex}.apks
+function sign_bundles() {
+  ${DEV_SIGN_BUNDLE} --input_dir "${DIST_DIR}"
+}
+
+
+function configure_build() {
+  # Assign to a variable and eval that, since bash ignores any error status from
+  # the command substitution if it's directly on the eval line.
+  local -r vars="$(TARGET_PRODUCT='' build/soong/soong_ui.bash --dumpvars-mode \
+    --vars="TMPDIR OUT_DIR")"
+  eval "${vars}"
+
+  declare -gr BUNDLETOOL=${OUT_DIR}/host/linux-x86/bin/bundletool
+  declare -gr MERGE_ZIPS=${OUT_DIR}/host/linux-x86/bin/merge_zips
+  declare -gr DEV_SIGN_BUNDLE=${OUT_DIR}/host/linux-x86/bin/dev_sign_bundle
+}
+
+
+function main() {
+  [[ -e "build/make/core/Makefile" ]] || die "$0 must be run from the top of the Android source tree."
+  configure_build
+  build_modules bundletool merge_zips dev_sign_bundle
+  build_bundles # use bundletool & merge_zips
+  sign_bundles # use dev_sign_bundle
+}
+
+
+main
diff --git a/libwvdrmengine/apex/device/widevine_generic.mk b/libwvdrmengine/apex/device/widevine_generic.mk
new file mode 100644
index 00000000..933a8831
--- /dev/null
+++ b/libwvdrmengine/apex/device/widevine_generic.mk
@@ -0,0 +1,3 @@
+$(call inherit-product, $(TARGET_BASE_PRODUCT))
+
+include vendor/widevine/libwvdrmengine/apex/device/device.mk