Migrating Chromium builds from Reclient to Siso

This document provides instructions on the configuration changes you need to make so that remote execution actions for your Chromium builds are sent to your EngFlow cluster by the Siso build tool instead of Reclient.

Supported platforms

Starting with Chromium 145 (Jan 2026), EngFlow supports remote execution for Chromium builds with Siso on Linux, macOS, and Windows.

Best practice for migration

Test these changes in your development branch before merging them into your main branch.

Step 1: Check out Chromium source code

Go to Get the Code: Checkout, Build, & Run Chromium and follow the installation instructions for your platform.

Step 2: Add custom variables to .gclient

1. Add the custom_vars in the code sample below to your chromium/.gclient file. You need to do this once per checkout (i.e., per machine).

   "reapi_address": "<clustername>.cluster.engflow.com"
   "reapi_instance": "default"
   "rbe_instance": "default"
   

   Here’s a sample chromium/.gclient file with the above custom_vars added:

   solutions = [
     {
       "name": "src",
       "url": "https://chromium.googlesource.com/chromium/src.git",
       "managed": False,
       "custom_deps": {},
       "custom_vars": {
         "rbe_instance": "default",
         "reapi_instance": "default",
         "reapi_address": "<clustername>.cluster.engflow.com:443",
       },
     },
   ]
   

2. Edit build/config/siso/backend_config/backend.star to remove Google-specific RE property labels by commenting out label:*

3. Run gcloud sync again. This updates the configuration in the source tree with the custom variables we specified in the previous step.

Step 3: Configure authentication

1. From your EngFlow cluster's Build and Test UI, go to the Getting Started section in the sidebar, and follow the instructions to generate and download the mTLS certificate.
2. Extract the contents of engflow-mTLS.zip.
3. Add environment variables to the following files:
   • To the absolute path of the engflow.crt file, add the RBE_tls_client_auth_cert environment variable.
   • To the absolute path of the engflow.key file, add the RBE_tls_client_auth_key environment variable.

Step 4: Configure EngFlow RBE

To configure siso to send actions to your EngFlow cluster:

1. Skip this step if you’ve already added the EngFlow reclient_configs repo to your DEPS file.
   Add the EngFlow reclient_configs repo to the DEPS file as shown below. For consistency, consider pinning the repository to a particular commit by adding the @<your-commit-hash> suffix.

   'src/third_party/reclient_configs': 'https://github.com/EngFlow/reclient-configs.git@<your-commit-hash>',
   

2. In the DEPS file, add the below stanza to the end of the hooks variable. This configuration will be applied when you run gclient sync in the next step.

   {
       'name': 'configure_reclient',
       'pattern': '.',
       'action': ['python3', 'src/third_party/reclient_configs/configure_reclient.py', '--src_dir=src'],
   },
   

3. Run gclient sync to check out the reclient_configs repo and generate configuration files.

4. Run gn args out/default and add the following lines:

   use_siso=true 
   use_remoteexec=true
   use_reclient=false
   

5. Run siso ninja -C out/default base_unittests

This will send actions to execute remotely on workers in your EngFlow cluster.

Note

By default, siso falls back to local execution when actions fail remotely. For testing purposes, you can pass --strict_remote=true to ensure your build is using remote execution with EngFlow.

For production usage, we do not recommend setting --strict_remote=true because not all of Chromium can be built remotely.

Troubleshooting

The siso ninja -C out/default base_unittests command results in an auth error. How do I fix this?

This is commonly caused by a problem with the way you initially set up Chromium where it’s expecting to build against Google. Here's a sample error message:

$ src % siso ninja -C out/default base_unittests
ninja: Entering directory `out/default'
0.58s init credentials by "luci-auth" failed 

0.59s Error: need to run `siso login`: Not logged in.

Log in by running:
   `$ luci-auth login -scopes-context`

To fix this error:

1. Verify that you've configured the correct cluster in the <src>/build/config/siso/.sisoenv file.
2. Verify environment variables from Step 3 are set by running env | grep RBE_.

The siso ninja -C out/default base_unittests command results in execvp(../../buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper, ...). How do I fix this?

This is a common error when building versions of Chromium older than 145, which are missing some configuration fixes.

build step: cc "./obj/third_party/zlib/zlib_data_chunk_simd/inffast_chunk.obj"
siso_rule: clang-cl/cc
stderr:
F0119 13:53:04.816010    6836 process-wrapper-legacy.cc:80] execvp(../../buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper, ...)
*** Check failure stack trace: ***
    @           0x4008b6  LegacyProcessWrapper::SpawnChild()
    @           0x405789  LegacyProcessWrapper::RunCommand()
    @           0x404354  main
    @           0x4af2f9  __libc_start_main

build failed

To fix this error:

1. Ensure that you have a checkout of Chromium 145 (or newer).
2. If you're unable to upgrade, you can also try cherry-picking this CL.