we can express USE flag blockers pretty easily.  something like:
trunks.ebuild:
  RDEPEND="tpm2? ( !app-crypt/tpm-tools[mocktpm] )"

i obviously have no idea what flags build what, but that should give you an idea of how to implement this :).

The conflict is that both tpm-tools and trunks packages contain tpm_version: the former for 1.2 case, the latter for 2.0 (CL:393338). So, before trunks can be emerged, tpm-tools must be uninstalled.

Iiuc the blockers example suggested that tpm-tools should be installed only if USE=tpm is specified. But isn't it the case already? And will it help (unlike the example tpm-tools was already pre-emerged on poppy, so https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/USE#Adapting_the_entire_system_to_the_new_USE_flags)?

$ equery-lulu d tpm-tools
 * These packages depend on tpm-tools:
virtual/target-chromium-os-dev-1-r21 (tpm ? app-crypt/tpm-tools)
virtual/target-chromium-os-test-1-r47 (tpm ? app-crypt/tpm-tools)

Can anything be actually done without either (a) emerge --depclean for tpm-tools, or (b) clearing the /build/poppy directory and re-building the packages from scratch? 

if you add blockers, then emerge will either tell you up front you need to resolve the conflicts, or it'll automatically rebuild the relevant packages if the USE flags change

the logic in the virtuals isn't sufficient here.

Sure, it's easy to add RDEPEND="!app-crypt/tpm-tools" to trunks ebuild. They should never be both installed due to overlapping files whatever the USE flags are. Plus, tpm-tools is of no use for tpm 2.0 cases, and trunks is of no use for tpm 1.2 cases anyways. 

I'm just trying to understand for the future: 
What do we achieve by doing that? RDEPEND in trunks won't automagically uninstall the previously installed tpm-tools anyways, will it? It will just tell that I need to resolve the conflict when attempting to emerge trunks. But isn't it what the original error message says (plus says why)?

My understanding always was that if you change USE flags, there is always a chance you may have to uninstall the previously installed packages that conflict with these flags through one of the two methods in comment #2 - manually, or by rebuilding packages from scratch. With or without this new RDEPEND that'd have to be done anyways. Or do I miss something?

portage will use a blocker in RDEPEND to automatically unmerge packages that nothing depends on anymore

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

 Issue 868331  has been merged into this issue.

Still an issue when converting from tpm to tpm2:

trunks-0.0.1-r2548:  * Detected file collision(s):
trunks-0.0.1-r2548:  * 
trunks-0.0.1-r2548:  * 	/build/dragonegg/usr/sbin/tpm_version

https://luci-logdog.appspot.com/v/?s=chromeos/bb/chromeos/dragonegg-paladin/310/+/recipes/steps/BuildPackages/0/stdout

(CL that caused the issue: https://chromium-review.googlesource.com/c/chromiumos/overlays/board-overlays/+/1148550/4/baseboard-dragonegg/profiles/base/make.defaults)

Hm, #4 + #5 (implemented in CL https://crrev.com/c/1164568) doesn't seem to work. trousers is not auto-unmerged. Or, did I get the use case wrong, and it is only supposed to work for complete build_packages again?

If on a TPM1.2 device (I'm using gale, don't ask) I do build_packages and then "USE=tpm2 emerge-$BOARD trunks" (USE=tpm2 is optional), it still fails with:

-----------------

[ebuild  N    *] chromeos-base/trunks-9999 to /build/gale/ USE="cros-debug -asan -cr50_onboard -cros_host -ftdi_tpm -fuzzer {-test} -tpm2_simulator" 
[blocks B      ] app-crypt/tpm-tools ("app-crypt/tpm-tools" is blocking chromeos-base/trunks-9999)

 * Error: The above package list contains packages which cannot be
 * installed at the same time on the same system.

  (chromeos-base/trunks-9999:0/0::chromiumos, ebuild scheduled for merge to '/build/gale/') pulled in by
    trunks

  (app-crypt/tpm-tools-1.3.8-r2:0/0::chromiumos, installed in '/build/gale/') pulled in by
    app-crypt/tpm-tools required by (virtual/target-chromium-os-test-1-r71:0/0::chromiumos, installed in '/build/gale/')
    app-crypt/tpm-tools required by (virtual/target-chromium-os-dev-1-r35:0/0::chromiumos, installed in '/build/gale/') 

-----------------

Yes, for build_packages, the CL from #12 makes a difference.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/4a88456c87a0447cdcc57e3af513c07e88c086bf

commit 4a88456c87a0447cdcc57e3af513c07e88c086bf
Author: Andrey Pronin <apronin@chromium.org>
Date: Tue Aug 07 21:37:08 2018

trunks: allow transition from USE=tpm to USE=tpm2

If a board image was built with USE="tpm -tpm2", an incremental build
with USE="-tpm tpm2" leads to

 * Detected file collision(s):
 *
 * 	/build/gale/usr/sbin/tpm_version
...
 * Package 'chromeos-base/trunks-9999' NOT merged due to file collisions.

since both trousers (emerged when USE=tpm) and trunksd (USE=tpm2) both
install tpm_version.

BUG= chromium:728863 
TEST=Doing (2) after (1) should succeed and not fail to emerge trunks
     due to conflicting tpm_versions:
     1) USE="-tpm2 tpm" ./build_packages --board=$BOARD
     2) USE="tpm2 -tpm" ./build_packages --board=$BOARD

Change-Id: I0271570665baa0329073218b5e8a741f508133b6
Reviewed-on: https://chromium-review.googlesource.com/1164568
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/4a88456c87a0447cdcc57e3af513c07e88c086bf/chromeos-base/trunks/trunks-9999.ebuild