Skip to content
NativeLink Docs

Chromium Cloud Quickstart

Reclient Configuration

Utilize NativeLink’s cloud CAS to build your Reclient Chromium projects. The following guide will help you set up your authentication keys (using mTLS) and configure Reclient for remote CAS usage.

1. Setup Reclient/Chromium for Linux

Start with Chromium by following the instructions here: Checking out and building Chromium for Linux. Follow the instructions up to “Setting up the build,” then stop and follow our instructions below. Don’t build Chromium yet.

Chromium Recommendations: We recommend creating the Chromium folder under your home directory:

Terminal window
mkdir $HOME/chromium

Set up your NativeLink configuration directory by running:

Terminal window
mkdir $HOME/nativelink-reclient

3. Generating your mTLS key files

Follow the instructions below in your terminal to generate the mTLS keys. These keys allow your local machine to communicate with our remote CAS:

Terminal window
cd $HOME/nativelink-reclient
mkdir certs && cd certs
openssl req -x509 -sha256 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 356 -nodes -subj '/CN=NativeLink-Server'
openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -nodes -subj '/CN=NativeLink-Client'
openssl x509 -req -sha256 -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 02 -out client.crt

Verify your certs are correct by running:

Terminal window
openssl verify -CAfile ca.crt client.crt

To get the contents of your cert, run:

Terminal window
cat ca.crt

5. Setup your environment

Create an environment variables file:

Terminal window
cd $HOME/nativelink-reclient
touch .env.local

Then save the below contents into your newly created .env.local file:

Terminal window
# If you have a different CACHE url or
# your CERT/KEY is in a different location
# you can update those here
export CACHE_ADDRESS=cas-blake.build-faster.nativelink.net:443
export TLS_CLIENT_AUTH_CERT=$HOME/nativelink-reclient/certs/client.crt
export TLS_CLIENT_AUTH_KEY=$HOME/nativelink-reclient/certs/client.key


# Leave below as is
export RBE_service=${CACHE_ADDRESS}
export RBE_cas_service=${CACHE_ADDRESS}
export RBE_reclient_timeout=60m
export RBE_instance=
export RBE_exec_timeout=4m
export RBE_alsologtostderr=true
export RBE_service_no_security=false
export RBE_local_resource_fraction=0.00001
export RBE_automatic_auth=false
export RBE_gcert_refresh_timeout=20
export RBE_compression_threshold=-1
export RBE_metrics_namespace=main
export RBE_platform=
export RBE_experimental_credentials_helper=
export RBE_experimental_credentials_helper_args=
export RBE_log_http_calls=true
export RBE_use_rpc_credentials=true
export RBE_exec_strategy=local
export RBE_remote_disabled=false
export RBE_tls_client_auth_cert=${TLS_CLIENT_AUTH_CERT}
export RBE_tls_client_auth_key=${TLS_CLIENT_AUTH_KEY}
export RBE_service_no_auth=true
export RBE_use_application_default_credentials=true

6. Build Chromium

First, run a script to set some final configurations to optimize your build for remote caching. The —src_dir assumes Chromium under the $HOME directory:

Terminal window
cd $HOME/nativelink-reclient
git clone https://github.com/TraceMachina/reclient-configs.git
cd reclient-configs
python3 configure_reclient.py --verbose --force --src_dir=$HOME/chromium/src

You can then run the Chromium build:

Terminal window
cd $HOME/chromium/src
source $HOME/nativelink-reclient/.env.local
rm -rf out
gn gen --args="use_remoteexec=true is_debug=false is_component_build=true symbol_level=0 rbe_cfg_dir=\"../../buildtools/reclient_cfgs\"" out/Default
autoninja -C out/Default chrome

7. Watch the execution

In a new terminal window, execute the following:

Terminal window
watch ${HOME}/chromium/src/buildtools/reclient/reproxystatus