The dependencies are weird here.

Nyan seems to bring this in with dnsmasq...
(cr) ((15fa4b1...)) bhthompson@ragnarok ~/trunk/src/scripts $ equery-nyan d libnetfilter_conntrack
 * These packages depend on libnetfilter_conntrack:
net-dns/dnsmasq-2.72-r4 (!s390 ? net-libs/libnetfilter_conntrack)

Nyan_big does not bring this in at all...
(cr) ((15fa4b1...)) bhthompson@ragnarok ~/trunk/src/scripts $ equery-nyan_big d libnetfilter_conntrack
 * These packages depend on libnetfilter_conntrack:

Caroline brings this in with conntrack-tools as well as dnsmasq
(cr) ((15fa4b1...)) bhthompson@ragnarok ~/trunk/src/scripts $ equery-caroline d libnetfilter_conntrack
 * These packages depend on libnetfilter_conntrack:
net-dns/dnsmasq-2.72-r4 (!s390 ? net-libs/libnetfilter_conntrack)
net-firewall/conntrack-tools-1.4.4-r5 (>=net-libs/libnetfilter_conntrack-1.0.6)

The iptables package itself as well as the libnetfilter_conntrack package are upstream portage, it seems to me if iptables has a run time dependency on libnetfilter_conntrack that it should define the dependency there?

We can also longer term work around this by not relying on Nyan in the Chrome PFQ https://chromium-review.googlesource.com/#/c/548437/ 

I can reproduce the failure locally, trying to figure out why nyan gets this but nyan_big does not.

Ignore the equery-nyan_big in comment 1, I had not built packages yet so it seems like equery was not quite working properly yet, after building packages it now shows that both nyan and nyan_big only get it through dnsmasq. 

However nyan_big does build_image successfully, and nyan does not, even though neither seems like it should be bringing in libnetfilter_conntrack, big does not show libnetfilter_conntrack in the build logs, yet it has iptables and is not failing test_image_content.sh.

Both nyan_big and nyan have the same USE flag settings for iptables, still not sure why they might be building  

They both have the same use flags except for variant_build, nyan_big, and board_use_nyan_big. 

Kevin could you take a look at this?

The CL https://chromium-review.googlesource.com/#/c/381017/ from a while back implies that libnetfilter_conntrack should not be used on systems with older kernels like this, so I am hesitant to just add libnetfilter_conntrack to the dependency graph here. 

FWIW, something like https://chromium-review.googlesource.com/#/c/549018/ seems to fix build_image, but I am not sure if this will break anything functionally. 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/8f325531e2c7e1a777a9ec11cf96608cf916aeb3

commit 8f325531e2c7e1a777a9ec11cf96608cf916aeb3
Author: Kevin Cernekee <cernekee@chromium.org>
Date: Tue Jun 27 17:55:44 2017

net-firewall/iptables: Enable new USE flags

Newer ebuilds require USE flags to explicitly enable features that are
currently enabled by default.

BUG= chromium:736796 
TEST=manually build + deploy on caroline

Change-Id: I3fcb50e35bb489761bafd3414f731b444e02ba05
Reviewed-on: https://chromium-review.googlesource.com/549080
Commit-Ready: Kevin Cernekee <cernekee@chromium.org>
Tested-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/8f325531e2c7e1a777a9ec11cf96608cf916aeb3/profiles/targets/chromeos/package.use

This was breaking lakitu too:
https://uberchromegw.corp.google.com/i/chromeos/builders/lakitu_next-incremental/builds/12193

and blocking commits as its failing on pre_cq as well:
https://luci-milo.appspot.com/buildbot/chromiumos.tryserver/pre_cq/41189

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528

commit 5cfb02b6fe50d46cf37fe25c13b1946fcfba8528
Author: Kevin Cernekee <cernekee@chromium.org>
Date: Tue Jun 27 17:55:44 2017

iptables: upgraded package to upstream

Upgraded net-firewall/iptables to version 1.4.21-r4 on amd64

BUG= chromium:736796 
TEST=manually build and deploy on caroline
CQ-DEPEND=CL:549080

Change-Id: Ibcbb2b6f93950332f459b83d259ebae1959ae15d
Reviewed-on: https://chromium-review.googlesource.com/548963
Commit-Ready: Kevin Cernekee <cernekee@chromium.org>
Tested-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[add] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/metadata/md5-cache/net-firewall/iptables-1.4.21-r4
[modify] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/files/systemd/ip6tables-restore.service
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/metadata/md5-cache/net-firewall/iptables-1.4.21-r1
[modify] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/files/systemd/iptables-restore.service
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.17-libip6tc.patch
[rename] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/files/iptables.init
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.18-extensions-link.patch
[modify] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/files/iptables-1.4.13-r1.init
[add] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/files/iptables-1.4.21-configure.patch
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/ip6tables-1.3.2.confd
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.18-ipv6-linkage.patch
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.11.1-man-fixes.patch
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.16.2-static.patch
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.12.1-lm.patch
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.3.2.init
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.12.1-conntrack-v2-ranges.patch
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.4.11.init
[delete] https://crrev.com/cdd006e1fb68ee7e9ce13a9c9e7e7dc65ae5241a/net-firewall/iptables/files/iptables-1.3.2.confd
[modify] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/metadata.xml
[rename] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/iptables-1.4.21-r4.ebuild
[add] https://crrev.com/5cfb02b6fe50d46cf37fe25c13b1946fcfba8528/net-firewall/iptables/files/iptables-1.4.21-static-connlabel-config.patch

+lakitu-dev as it's breaking lakitu. Kevin, is the change above alone going to fix it?

The most recent lakitu build failed here:

https://uberchromegw.corp.google.com/i/chromeos/builders/lakitu_next-incremental/builds/12195/steps/BuildImage/logs/stdio

ERROR   : test_elf_deps: Failed dependency check
ERROR   : Package: net-firewall/iptables-1.4.21-r1
ERROR   : /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/rootfs/usr/lib64/xtables/libxt_connlabel.so (interpreter => None)
ERROR   :     libxtables.so.10 => /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/rootfs/lib64/libxtables.so.10
ERROR   :         libdl.so.2 => /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/rootfs/lib64/libdl.so.2
ERROR   :             ld-linux-x86-64.so.2 => /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/rootfs/lib64/ld-linux-x86-64.so.2
ERROR   :     libnetfilter_conntrack.so.3 => None
ERROR   :     libc.so.6 => /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/rootfs/lib64/libc.so.6
INFO    : Unmounting image from /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/stateful and /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/rootfs
Cleaning up /usr/local symlinks for /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1/stateful/dev_image
An error occurred in your build so your latest output directory is invalid.
Running in non-interactive mode so deleting output directory.
Deleted /mnt/host/source/src/build/images/lakitu_next/R61-9691.0.2017_06_27_1110-a1
11:20:20: ERROR: 
return code: 1; command: /b/c/cbuild/repository/chromite/bin/cros_sdk 'PARALLEL_EMERGE_STATUS_FILE=/tmp/tmpjD3vrX' 'USE=chrome_internal' 'FEATURES=separatedebug' 'IGNORE_PREFLIGHT_BINHOST=1' -- ./build_image '--board=lakitu_next' --replace '--version=' '--builder_path=lakitu_next-incremental/R61-9691.0.0-b12195' '--disk_layout=base' test
cmd=['/b/c/cbuild/repository/chromite/bin/cros_sdk', 'PARALLEL_EMERGE_STATUS_FILE=/tmp/tmpjD3vrX', u'USE=chrome_internal', 'FEATURES=separatedebug', 'IGNORE_PREFLIGHT_BINHOST=1', '--', './build_image', u'--board=lakitu_next', '--replace', '--version=', u'--builder_path=lakitu_next-incremental/R61-9691.0.0-b12195', u'--disk_layout=base', u'test'], cwd=/b/c/cbuild/repository, extra env={'PARALLEL_EMERGE_STATUS_FILE': '/tmp/tmpjD3vrX', 'USE': u'chrome_internal', 'FEATURES': 'separatedebug', 'IGNORE_PREFLIGHT_BINHOST': '1'}

@@@STEP_FAILURE@@@
11:20:20: ERROR: ./build_image failed (code=1)


This was still using the old 1.4.21-r1 package.  I expect that the dependency fix in the new -r4 package will make the check succeed.

Yes it's promising. The ongoing lakitu-incremental build has passed BuildImage stage. https://uberchromegw.corp.google.com/i/chromeos/builders/lakitu-incremental/builds/16648

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/chromite/+/db8e45b89b2e1acabb0052a1a4baef815d8eb293

commit db8e45b89b2e1acabb0052a1a4baef815d8eb293
Author: Bernie Thompson <bhthompson@google.com>
Date: Wed Jun 28 07:59:05 2017

Swap nyan chrome pfq builder for nyan_big

The nyan build is not well kept and not in the paladin array, however nyan_big
is productionized and more likely to be noticed if it breaks.

BUG= chromium:736796 
TEST=None

Change-Id: I1778cd65943781e82425635c15bb290347ab00fb
Reviewed-on: https://chromium-review.googlesource.com/548437
Commit-Ready: Bernie Thompson <bhthompson@chromium.org>
Tested-by: Bernie Thompson <bhthompson@chromium.org>
Reviewed-by: Ilja H. Friedel <ihf@chromium.org>
Reviewed-by: Don Garrett <dgarrett@chromium.org>

[modify] https://crrev.com/db8e45b89b2e1acabb0052a1a4baef815d8eb293/cbuildbot/config_dump.json
[modify] https://crrev.com/db8e45b89b2e1acabb0052a1a4baef815d8eb293/cbuildbot/waterfall_layout_dump.txt
[modify] https://crrev.com/db8e45b89b2e1acabb0052a1a4baef815d8eb293/cbuildbot/chromeos_config.py