SISO(1)

📦 version 1.5.22, in ubuntu stonking

💅 siso — SISO(1) 💅

General Commands Manual · periodt, bestie, let's get into it

🎀 NAME 🎀

siso — Ninja-compatible build system optimized for remote execution.

✨ SYNOPSIS ✨

siso [global flags] command [arguments]

🦋 DESCRIPTION 🦋

Ok so picture this: siso is a build tool whose whole entire personality is making Chromium and Android builds go zoomie. It's built as a drop-in replacement for Ninja, which means you literally do not have to touch your workflow, change a single habit, or text your team "hey we're migrating" — it just slots right in. Slay.

siso runs build actions natively on Remote Build Execution (RBE) and squeezes out performance by dodging stat, disk, and network I/O as much as it physically can. It keeps resource consumption low by sharing a single process memory space, and it hoards detailed performance metrics for every build action so you can go analyze them with cloud tracing and profiling tools. Metrics girlie behavior fr fr. 🌈

🌈 GLOBAL FLAGS 🌈

-alsologtostderr=false — log to standard error as well as files
-blockprof_rate=0 — block profile rate
-blockprofile — write block profile to this file
-cpuprofile — write cpu profile to this file
-credential_helper=google-application-default — path to a credential helper. The lore lives here: https://github.com/EngFlow/credential-helper-spec/blob/main/spec.md
- luci-auth uses luci-auth.
- gcloud uses gcloud.
- google-application-default or "" uses Google Application Default Credentials.
- mTLS disables per RPC credentials.
- environment variable SISO_CREDENTIAL_HELPER sets the default value.
-log_backtrace_at — when logging hits line file:N, emit a stack trace
-log_dir — If non-empty, write log files in this directory
-log_link — If non-empty, add symbolic links in this directory to the log files
-logbuflevel=0 — Buffer log messages logged at this level or lower (-1 means don't buffer; 0 means buffer INFO only; ...). Has limited applicability on non-prod platforms.
-logtostderr=false — log to standard error instead of files
-memprofile — write memory profile to this file
-memprofile_gc=true — run runtime.GC() before each heap profile dump for a cleaner inuse view
-memprofile_interval=0s — if non-zero, dump heap profiles at this interval to rolling files derived from -memprofile (e.g. siso-memory.0001.pprof); the bare -memprofile path is not written. yes she said rolling files, she's extra like that
-mutexprof_frac=0 — mutex profile fraction
-mutexprofile — write mutex profile to this file
-pprof_addr — listen address for go tool pprof. e.g. localhost:6060
-stderrthreshold=2 — logs at or above this threshold go to stderr
-trace — go trace output for go tool trace
-v=0 — log level for V logs
-version=false — print version
-vmodule — comma-separated list of pattern=N settings for file-filtered logging

🧚 SUBCOMMANDS 🧚

👑 MAIN COMMANDS 👑

🥷 `ninja` — build the requested targets as ninja

build the requested targets as ninja. She does exactly what it says on the tin, no notes. 💅

$ siso ninja [-C <dir>] [options] [targets...]

Flags:

-C=. — ninja running directory (chdir before run)
-action_salt — action salt
-batch=true — batch mode. prefer thoughput over low latency for build failures. disable -fast_nop, -fast_local -fast_last_failure -fast_exit
-build_id=00000000-0000-0000-0000-000000000000 — ID for the build. used for invocation_id of remote-apis-sdks and tool_invocation_id of remote-apis, and Cloud logging resource build_id label.
-build_pprof=siso_build.pprof — build pprof filename (relative to -log_dir)
-cache_dir=$HOME/.cache/siso — cache directory
-cache_enable_read=true — cache enable read
-cartfs_endpoint — cartfs server endpoint. e.g. localhost:65001
-cleandead=false — clean built files that are no longer produced by the manifest
-clobber=false — clobber build
-cloud_profiler_service_name=siso — cloud profiler service name
-collector_address — address to dial the collector. Can be path for unix socket unix:///path/to/socket or host:port.
-config — config name passed to starlark
-config_repo_dir=build/config/siso — config repo directory (relative to workspace)
-d — enable debugging (use -d list to list modes)
-deps_log=.siso_deps — deps log filename (relative to -C, -state_dir)
-enable_build_ninja_files_upload=false — enable Build Ninja files upload to RBE-CAS
-enable_cloud_logging=false — enable cloud logging
-enable_cloud_monitoring=false — enable cloud monitoring
-enable_cloud_profiler=false — enable cloud profiler
-enable_cloud_trace=false — enable cloud trace
-enable_collector=false — enable OTEL collector. Effectively not active, will be removed later. TODO: b/455433899.
-enable_resultstore=false — enable resultstore
-explain_log=siso_explain — explain log filename (relative to -log_dir)
-f=build.ninja — input build manifest filename (relative to -C)
-failed_commands=siso_failed_commands.sh — script file to rerun the last failed commands
-failure_summary — filename for failure summary (relative to -log_dir)
-fast_exit=false — enable fast exit
-fast_last_failure=false — enable fast last failure check
-fast_local=false — enable fast local
-fast_nop=false — enable fast nop check
-frontend_file — frontend FIFO file to report build status to soong ui, or - to report to stdout.
-fs_defer_digest=false — defer digest calculation
-fs_digest_xattr — xattr for sha256 digest; empty enables the default on Cog/CartFS only
-fs_keep_tainted=false — keep manually modified generated file
-fs_min_flush_timeout=30s — minimum timeout for flush. ignored if it is shorter than 10s
-fs_state=.siso_fs_state — fs state filename
-fs_state_compression_level=1 — fs state compression level (1 = fastest, 10 = best)
-fs_state_compression_threads=8 — number of threads to use for data compression
-fs_state_mmap=true — use memory-mapped I/O for state file reads/writes
-heartbeat_period=0s — print a heartbeat with this frequency on the console when --quiet is set and this value is non zero.
-invocation_json=siso_metadata.json — invocation metadata JSON filename (relative to -log_dir)
-j=-1 — not supported. use -remote_jobs and -local_jobs instead
-job_id=00000000-0000-0000-0000-000000000000 — ID for a grouping of related builds such as a Buildbucket job. used for correlated_invocations_id of remote-apis and remote-apis-sdks, and Cloud logging resource job_id label.
-k=1 — keep going until N jobs fail (0 means inifinity)
-l=-1 — not supported.
-load=@config//main.star — config filename (@config// is --config_repo_dir)
-local_cache_enable=false — local cache enable
-local_jobs=0 — run N local jobs in parallel. when the value is no positive, the default will be computed based on # of CPUs.
-localexec_log=siso_localexec — localexec log filename (relative to -log_dir)
-log_dir — log directory (relative to -C) [default: same dir as build.ninja]
-metrics_json=siso_metrics.json — metrics JSON filename (relative to -log_dir)
-metrics_labels — comma-separated arbitrary key value pairs in the form key=value, which are added to cloud monitoring metrics and siso_metadata.json.
-metrics_project — override Cloud Monitoring GCP project where Siso sends action and build metrics.
-n=false — dry run
-namespace — namespace for cloud logging's resource label
-o=false — alias of -offline
-offline=false — offline mode.
-output_local_strategy=full — strategy for output_local. "full": download all outputs. "greedy": downloads most outputs except intermediate objs. "minimum": downloads as few as possible. "graph": downloads only remote outputs that a local step will consume, decided at schedule time from the dep graph, spreading downloads over the compile burst. "pathfilter:<path_filter>": use path filter. "patterns:<pattern-list>": colon-separated pathfilter's patterns
-output_log=siso_output — output log filename (relative to -log_dir)
-prepare=false — build inputs of targets, but not build target itself.
-project — cloud project ID. can set by $SISO_PROJECT
-quiet=false — don't show progress status, just command output
-re_cache_enable_read=true — remote exec cache enable read
-re_cache_enable_write=false — remote exec cache allow local trusted uploads
-re_exec_enable=true — remote exec enable
-reapi_address=remotebuildexecution.googleapis.com:443 — reapi address
-reapi_batch_compress_blob=0 — use compressed blobs in BatchUpdateBlobs if server supports it and size is bigger than this. specify 0 to disable.
-reapi_byte_stream_read_threshold=2097152 — if blob size >= threshold, use ByteStream API (compression-aware)
-reapi_cas_address — reapi cas address (if empty, share conn with reapi_address)
-reapi_compress_blob=1024 — use compressed blobs if server supports compressed blobs and size is bigger than this. specify 0 to disable blob-level compression.
-reapi_digest_function=sha256 — which digest function we use for content. pick from: sha256, sha1, gitsha1, blake3, md5, sha384, sha512, murmur3, vso, or sha256tree ✨
-reapi_enable_grpc_compression=false — turn on grpc compression. heads up bestie: if you enable this, blob-level compression gets forcibly disabled. no cap 🫶
-reapi_grpc_conn_pool=25 — the grpc connection pool 💅
-reapi_grpc_keepalive_permit_without_stream=false — grpc keepalive permit without stream
-reapi_grpc_keepalive_time=30s — grpc keepalive time
-reapi_grpc_keepalive_timeout=20s — grpc keepalive timeout
-reapi_insecure=false — reapi insecure mode. the default can be set by $RBE_service_no_security 👀
-reapi_instance=default_instance — the reapi instance name. (for Google RBE: if the instance is fully qualified (starts with projects/), the project ID gets inferred from it. otherwise, the project ID from -project (or $SISO_PROJECT) is used to construct the instance name. if both are provided, -project is used for other cloud services) 💖
-reapi_keep_exec_stream=false — keep the Execute stream open as long as possible
-reapi_max_retries=10 — max retries for remote execution
-reapi_priority=0 — reapi priority for action executions. the semantics and supported values depend on the backend 🤷♀️
-reapi_tls_ca_cert — load TLS CA certificates from this file to connect to the RE api service. default can be set by $RBE_tls_ca_cert
-reapi_tls_client_auth_cert — certificate to use when using mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_cert
-reapi_tls_client_auth_key — key to use when using mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_key
-reapi_trace_cookie — if set, it's sent as the cookie gRPC metadata header on every RPC to this backend, to force server-side trace sampling (e.g. Dapper) 🔍
-reapi_version_to_use — specify the re api version to use, in the format v<major>.<minor>. e.g. v2.0
-remote_jobs=0 — run N remote jobs in parallel. when the value is not positive, the default gets computed based on # of CPUs 🔥
-spawn_helper — command name of external spawn helper. use builtin spawn helper if empty.
-state_dir — state directory (relative to -C) [default: same dir as build.ninja]
-strict_remote=false — don't use local for remote step. i.e. no fastlocal, no local fallback 🚫
-t — run a subtool (use -t list to list subtools)
-trace_json=siso_trace.json — trace JSON filename (relative to -log_dir)
-trace_span_threshold=100ms — theshold for trace span record
-trace_threshold=1m0s — threshold for trace record
-v=false — show all command lines while building (alias of --verbose)
-verbose=false — show all command lines while building
-verbose_failures=true — show failed command lines
-w — adjust warnings. not supported b/288807840 😭
-write_reclient_metrics_logs=false — write Reclient's RBE build metrics to rbe_metrics.{txt, pb} under -log_dir.

🌈 REAPI 🌈

🦋 fetch — fetch contents

babes, this one fetches contents from CAS or ActionResult. it prints contents to stdout, or extracts into <dir> for -type *-extract 💖

$ siso fetch [-project <project>] [-reapi_instance <instance>] \
         [-type <type>] \
         <digest> [<dir>]
$ siso fetch [-type <type>] \
 bytesteam://<endpoint>/projects/<project>/instances/<instance>/blobs/<digest>

Flags ✨:

-project — cloud project ID. can be set by $SISO_PROJECT
-reapi_address=remotebuildexecution.googleapis.com:443 — reapi address
-reapi_batch_compress_blob=0 — use compressed blobs in BatchUpdateBlobs if the server supports it and the size is bigger than this. specify 0 to disable.
-reapi_byte_stream_read_threshold=2097152 — if blob size >= threshold, use the ByteStream API (compression-aware)
-reapi_cas_address — reapi cas address (if empty, share conn with reapi_address)
-reapi_compress_blob=1024 — use compressed blobs if the server supports compressed blobs and the size is bigger than this. specify 0 to disable blob-level compression.
-reapi_digest_function=sha256 — content digest function: sha256, sha1, gitsha1, blake3, md5, sha384, sha512, murmur3, vso, or sha256tree
-reapi_enable_grpc_compression=false — enable grpc compression. if enabled, blob-level compression will be forcibly disabled. 💀
-reapi_grpc_conn_pool=25 — grpc connection pool
-reapi_grpc_keepalive_permit_without_stream=false — grpc keepalive permit without stream
-reapi_grpc_keepalive_time=30s — grpc keepalive time
-reapi_grpc_keepalive_timeout=20s — grpc keepalive timeout
-reapi_insecure=false — reapi insecure mode. default can be set by $RBE_service_no_security
-reapi_instance=default_instance — reapi instance name. (for Google RBE: if instance is fully qualified (starts with projects/), project ID is inferred from it. Otherwise, project ID from -project (or $SISO_PROJECT) is used to construct the instance name. If both are provided, -project is used for other cloud services)
-reapi_keep_exec_stream=false — keep Execute stream open as long as possible
-reapi_max_retries=10 — max retries for remote execution
-reapi_priority=0 — reapi priority for action executions. The semantics and supported values depend on the backend
-reapi_tls_ca_cert — Load TLS CA certificates from this file to connect to the RE api service. default can be set by $RBE_tls_ca_cert
-reapi_tls_client_auth_cert — Certificate to use when using mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_cert
-reapi_tls_client_auth_key — Key to use when using mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_key
-reapi_trace_cookie — if set, sent as the cookie gRPC metadata header on every RPC to this backend, to force server-side trace sampling (e.g. Dapper)
-reapi_version_to_use — specify re api version to use, in format of v<major>.<minor>. e.g. v2.0
-type=raw — data type. here's the whole menu 🍓:
- raw: raw content
- command: command message in text proto format
- action: action message in text proto format
- result: action result message in text proto format
- dir: directory message in text proto format
- tree: tree message in text proto format
- dir-extract: directory message extract to <dir> (if <dir> is specified) or list (if <dir> is not specified)
- tree-extract: tree message extract to <dir> (if <dir> is specified) or list (if <dir> is not specified)
- action-list: actions associated with two phase cache key.

🧚 isolate — isolate uploads and computes tree digests

isolate uploads and computes tree digest for each targets 💅

$ siso isolate [-project <project>] [-src_cas_instance <instance>] \
    -C <dir> \
    -dst_cas_instance projects/<cas project>/instances/<instance> \
    -dump_json <output json path> \
    <target> ...

Flags ✨:

-C=. — ninja running directory (chdir before run)
-cas_instance — alias of -dst_cas_instance for backward compatibility 👑
-config_repo_dir=build/config/siso — config repo directory (relative to workspace)
-dst_cas_address=remotebuildexecution.googleapis.com:443 — reapi address (for dst_cas)
-dst_cas_batch_compress_blob=0 — use compressed blobs in BatchUpdateBlobs if server supports it and size is bigger than this. specify 0 to disable. (for dst_cas)
-dst_cas_byte_stream_read_threshold=2097152 — if blob size >= threshold, use ByteStream API (compression-aware) (for dst_cas)
-dst_cas_compress_blob=1024 — use compressed blobs if server supports compressed blobs and size is bigger than this. specify 0 to disable blob-level compression. (for dst_cas)
-dst_cas_digest_function=sha256 — content digest function: sha256, sha1, gitsha1, blake3, md5, sha384, sha512, murmur3, vso, or sha256tree (for dst_cas)
-dst_cas_enable_grpc_compression=false — enable grpc compression. if enabled, blob-level compression will be forcibly disabled. (for dst_cas)
-dst_cas_grpc_conn_pool=25 — grpc connection pool
-dst_cas_grpc_keepalive_permit_without_stream=false — grpc keepalive permit without stream (for dst_cas)
-dst_cas_grpc_keepalive_time=30s — grpc keepalive time (for dst_cas)
-dst_cas_grpc_keepalive_timeout=20s — grpc keepalive timeout (for dst_cas)
-dst_cas_insecure=false — reapi insecure mode. default can be set by $RBE_service_no_security
-dst_cas_instance=default_instance — reapi instance name (for dst_cas)
-dst_cas_keep_exec_stream=false — keep Execute stream open as long as possible
-dst_cas_max_retries=10 — max retries for remote execution
-dst_cas_tls_ca_cert — Load TLS CA certificates from this file to connect to the RE api service. default can be set by $RBE_tls_ca_cert
-dst_cas_tls_client_auth_cert — the certificate you hand over when you're doing mTLS to talk to the RE api service. default can be set by $RBE_tls_client_auth_cert.
-dst_cas_tls_client_auth_key — the key that matches that cert for mTLS to the RE api service. default can be set by $RBE_tls_client_auth_key.
-dst_cas_trace_cookie — if you set it, it gets sent as the cookie gRPC metadata header on every single RPC to this backend, which forces server-side trace sampling (think Dapper). for dst_cas, bestie 🍓
-dst_cas_version_to_use — pick which re api version you wanna use, format is v<major>.<minor>. like v2.0. yes the angle brackets are literally part of the shape, don't @ me 💅
-dump_json — dump it into a json file 📄
-enable_cloud_logging=true — turn cloud logging on ✨
-fs_defer_digest=false — defer the digest calculation
-fs_digest_xattr — the xattr for the sha256 digest. leave it empty and the default only kicks in on Cog/CartFS
-fs_keep_tainted=false — keep that generated file you manually modified (we see you 👀)
-fs_min_flush_timeout=30s — minimum timeout for flush. heads up: this one is ignored if it's shorter than 10s
-fs_state=.siso_fs_state — the fs state filename
-fs_state_compression_level=1 — fs state compression level, where 1 = fastest and 10 = best 🏆
-fs_state_compression_threads=8 — how many threads to throw at data compression
-fs_state_mmap=true — use memory-mapped I/O for state file reads/writes
-job_id=00000000-0000-0000-0000-000000000000 — an ID for a group of related builds, like a Buildbucket job
-namespace — namespace for cloud logging's resource label
-project — the cloud project ID. can be set by $SISO_PROJECT
-src_cas_address=remotebuildexecution.googleapis.com:443 — the reapi address. for src_cas, obviously 💁
-src_cas_batch_compress_blob=0 — use compressed blobs in BatchUpdateBlobs if the server supports it and the size is bigger than this. specify 0 to disable. for src_cas
-src_cas_byte_stream_read_threshold=2097152 — if the blob size is >= the threshold, use the ByteStream API (compression-aware). for src_cas
-src_cas_compress_blob=1024 — use compressed blobs if the server supports compressed blobs and the size is bigger than this. specify 0 to disable blob-level compression. for src_cas
-src_cas_digest_function=sha256 — the content digest function, and your options are: sha256, sha1, gitsha1, blake3, md5, sha384, sha512, murmur3, vso, or sha256tree. for src_cas 🌈
-src_cas_enable_grpc_compression=false — enable grpc compression. but wait: if you enable this, blob-level compression gets forcibly disabled. for src_cas
-src_cas_grpc_conn_pool=25 — grpc connection pool
-src_cas_grpc_keepalive_permit_without_stream=false — grpc keepalive permit without stream. for src_cas
-src_cas_grpc_keepalive_time=30s — grpc keepalive time. for src_cas
-src_cas_grpc_keepalive_timeout=20s — grpc keepalive timeout. for src_cas
-src_cas_insecure=false — reapi insecure mode. default can be set by $RBE_service_no_security
-src_cas_instance=default_instance — reapi instance name. for src_cas
-src_cas_keep_exec_stream=false — keep the Execute stream open for as long as humanly possible 🫶
-src_cas_max_retries=10 — max retries for remote execution
-src_cas_tls_ca_cert — load TLS CA certificates from this file when connecting to the RE api service. default can be set by $RBE_tls_ca_cert
-src_cas_tls_client_auth_cert — the certificate you use when doing mTLS to the RE api service. default can be set by $RBE_tls_client_auth_cert
-src_cas_tls_client_auth_key — the key for that mTLS connection to the RE api service. default can be set by $RBE_tls_client_auth_key
-src_cas_trace_cookie — if set, it goes out as the cookie gRPC metadata header on every RPC to this backend to force server-side trace sampling (like Dapper). for src_cas
-src_cas_version_to_use — specify which re api version to use, in the format v<major>.<minor>. e.g. v2.0

🧚 `proxy` — proxy RE-API service

okay so this one literally proxies the RE API service. iconic behaviour honestly 👑

 $ siso proxy [-project <project>] [-reapi_address <addr>] [-reapi_instance <instance>] \
     -addr unix:///<path>

 $ siso ninja -reapi_address unix:///<path> --reapi_insecure=true ...

✨ Flags ✨

-addr — the address to listen on
-project — the cloud project ID. can be set by $SISO_PROJECT
-reapi_address=remotebuildexecution.googleapis.com:443 — the reapi address
-reapi_batch_compress_blob=0 — use compressed blobs in BatchUpdateBlobs if the server supports it and the size is bigger than this. specify 0 to disable.
-reapi_byte_stream_read_threshold=2097152 — if the blob size is >= the threshold, use the ByteStream API (compression-aware)
-reapi_cas_address — the reapi cas address. if it's empty, it shares the conn with reapi_address
-reapi_compress_blob=1024 — use compressed blobs if the server supports compressed blobs and the size is bigger than this. specify 0 to disable blob-level compression.
-reapi_digest_function=sha256 — the content digest function: sha256, sha1, gitsha1, blake3, md5, sha384, sha512, murmur3, vso, or sha256tree
-reapi_enable_grpc_compression=false — enable grpc compression. but: if you enable it, blob-level compression gets forcibly disabled.
-reapi_grpc_conn_pool=25 — grpc connection pool
-reapi_grpc_keepalive_permit_without_stream=false — grpc keepalive permit without stream
-reapi_grpc_keepalive_time=30s — grpc keepalive time
-reapi_grpc_keepalive_timeout=20s — grpc keepalive timeout
-reapi_insecure=false — reapi insecure mode. default can be set by $RBE_service_no_security
-reapi_instance=default_instance — reapi instance name. for Google RBE specifically: if the instance is fully qualified (starts with projects/), the project ID gets inferred from it. otherwise, the project ID from -project (or $SISO_PROJECT) is used to construct the instance name. and if you give both, -project is used for the other cloud services 💫
-reapi_keep_exec_stream=false — keep the Execute stream open as long as possible
-reapi_max_retries=10 — max retries for remote execution
-reapi_priority=0 — reapi priority for action executions. the semantics and the supported values are up to the backend, so like... ask your backend 🫠
-reapi_tls_ca_cert — load TLS CA certificates from this file to connect to the RE api service. default can be set by $RBE_tls_ca_cert
-reapi_tls_client_auth_cert — the certificate to use when connecting to the RE api service with mTLS. default can be set by $RBE_tls_client_auth_cert
-reapi_tls_client_auth_key — the key to use when connecting to the RE api service with mTLS. default can be set by $RBE_tls_client_auth_key
-reapi_trace_cookie — if set, it's sent as the cookie gRPC metadata header on every RPC to this backend, forcing server-side trace sampling (e.g. Dapper)
-reapi_version_to_use — specify which re api version to use, in the format v<major>.<minor>. e.g. v2.0

🦋 `recall` — recall action

recall an action by digest, or do a remote exec call to run it. it's giving time travel but for builds ⏪

to recall the action identified by <digest> in <dir>:

 $ siso recall [-project <project>] [-reapi_instance <instance>] \
     <dir> <digest>

inside <dir> you'll get "action.txt", "command.txt" and "root/".

and yes bestie, you may modify *.txt or the files in root/ 🌸

if you don't specify <digest>, it just runs the action in <dir>. and you can totally omit <dir> if it's the current directory ".". so convenient 💅

to issue a remote exec call to run the command:

 $ siso recall [-project <project>] [-reapi_instance <instance>] <dir>

to re-run the command on a remote worker without fetching cache:

 $ siso recall [-project <project>] [-reapi_instance <instance>] -re_cache_enable_read=false <dir>

to use local docker to run the command:

 $ siso recall [-local] <dir>

✨ Flags ✨

-cpus — how much of the available CPU resources the action can use (e.g. '1.5' for at most one and a half of the CPUs)
-exec_timeout=0s — set the exec call timeout
-execute_request — execute request proto
-hdd=false — run the action with slowed-down I/O that resembles a hard-disk with 12MB/s throughput, 75 read IOPS and 150 write IOPS 🐌
-local=false — force running the action locally using Docker, even if REAPI is configured
-memory — the maximum amount of memory the action can use (e.g. 512m or 2g)
-project — the cloud project ID. can be set by $SISO_PROJECT
-re_cache_enable_read=true — remote exec cache enable read
-reapi_address=remotebuildexecution.googleapis.com:443 — the reapi address
-reapi_batch_compress_blob=0 — use compressed blobs in BatchUpdateBlobs if the server supports it and the size is bigger than this. specify 0 to disable.
-reapi_byte_stream_read_threshold=2097152 — if the blob size is >= the threshold, use the ByteStream API (compression-aware)
-reapi_cas_address — the reapi cas address. if it's empty, it shares the conn with reapi_address
-reapi_compress_blob=1024 — use compressed blobs if the server supports compressed blobs and the size is bigger than this. specify 0 to disable blob-level compression.
-reapi_digest_function=sha256 — the content digest function: sha256, sha1, gitsha1, blake3, md5, sha384, sha512, murmur3, vso, or sha256tree
-reapi_enable_grpc_compression=false — turn grpc compression on. heads up bestie: the moment you flip this to enabled, blob-level compression gets forcibly disabled. it's giving either/or, no cap. 😤
-reapi_grpc_conn_pool=25 — grpc connection pool size.
-reapi_grpc_keepalive_permit_without_stream=false — grpc keepalive permit-without-stream toggle.
-reapi_grpc_keepalive_time=30s — grpc keepalive time. 🕰️
-reapi_grpc_keepalive_timeout=20s — grpc keepalive timeout.
-reapi_insecure=false — reapi insecure mode. your default can be set by $RBE_service_no_security instead of typing it every time. 💅
-reapi_instance=default_instance — the reapi instance name. for Google RBE there's a lil logic going on here: if the instance is fully qualified (starts with projects/), the project ID is inferred from it. otherwise, the project ID from -project (or $SISO_PROJECT) is used to build the instance name. and if you give both, then -project is what gets used for the other cloud services. okurrr. ✨
-reapi_keep_exec_stream=false — keep the Execute stream open as long as possible. clingy in the best way. 🫶
-reapi_max_retries=10 — max retries for remote execution.
-reapi_priority=0 — reapi priority for action executions. the semantics and supported values are fully up to the backend, so it's giving "iykyk". ✨
-reapi_tls_ca_cert — load TLS CA certificates from this file to connect to the RE api service. default can be set by $RBE_tls_ca_cert.
-reapi_tls_client_auth_cert — the certificate to use when you're doing mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_cert.
-reapi_tls_client_auth_key — the key to use when you're doing mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_key.
-reapi_trace_cookie — if you set this, it gets sent as the cookie gRPC metadata header on every RPC to this backend, which forces server-side trace sampling (think Dapper). 🍪
-reapi_version_to_use — pick which re api version to use, formatted like v<major>.<minor>, e.g. v2.0.
-stats=false — run the command under /usr/bin/time and print detailed resource stats once it's done. note: this may fail if the container's glibc is incompatible with the host. 💀

✨ INVESTIGATION ✨

🔍 `fs` — command group to access siso hashfs data

command group to access siso hashfs data. 🌸

just run siso fs to see all the subcommands. and for the tea on any one of them, use siso fs help [subcommand]. 🫶

📊 `metrics` — command group to analyze siso_metrics.json

command group to analyze siso_metrics.json.

run siso metrics to display the subcommands, and siso metrics help [subcommand] for more info about a specific subcommand. ✨

👀 `ps` — display running steps of ninja build

display the running steps of a ninja build. literally the main character of "what is my build doing rn". 👑

for a local build:

$ siso ps [-C dir]

for builders build:

$ siso ps --stdout_url <compile-step-stdout-URL>

flags:

-C=. — ninja running directory (chdir before run).
-config_repo_dir=build/config/siso — config repo directory (relative to the workspace).
-interval=-1ns — query interval, but only if it's positive. by default it's 1s on a terminal. ⏱️
-n=0 — limit the number of steps, if it's positive.
-state_dir=. — state directory (relative to -C).
-stdout_url — stdout streaming URL. 🌈

🧐 `query` — command group to query ninja build graph

command group to query ninja build graph.

use siso query to display subcommands, and siso query help [subcommand] when you need more info about one of them. 💜

📝 `report` — report siso logs

report siso logs. it collects siso logs in <dir>. 🎀

$ siso report -C <dir>

flags:

-C=. — ninja running directory (chdir before run).
-config_repo_dir=build/config/siso — config repo directory (relative to the workspace).
-fs_digest_xattr — xattr for sha256 digest; an empty value enables the default on Cog/CartFS only. 🍓

🌐 `webui` — starts the experimental webui

starts the experimental webui. bestie, listen: it is not ready for wide use yet, it requires static files to work, and it is subject to breaking changes at any moment. this one is giving "come back later" energy fr. 🚧

flags:

-C=. — ninja running directory (chdir before run).
-config_repo_dir=build/config/siso — config repo directory (relative to the workspace).
-f=build.ninja — input build manifest filename (relative to -C).
-local_development=false — whether to use local files instead of embedded files.
-metrics_file — optional path to siso_metrics.json to load (experimental, -C is still required for now).
-port=8080 — port to use (defaults to 8080). 🚪

🔐 AUTH 🔐

✅ `auth-check` — prints current auth status

prints current auth status. let's see who you are bestie. 💅

flags:

-check_reapi=true — check reapi call.
-project — cloud project ID. can be set by $SISO_PROJECT.
-read_only=false — check for read only access.
-reapi_address=remotebuildexecution.googleapis.com:443 — reapi address.
-reapi_batch_compress_blob=0 — use compressed blobs in BatchUpdateBlobs if the server supports it and the size is bigger than this. specify 0 to disable.
-reapi_byte_stream_read_threshold=2097152 — if blob size is >= this threshold, use the ByteStream API (compression-aware).
-reapi_cas_address — reapi cas address (if it's empty, share the conn with reapi_address).
-reapi_compress_blob=1024 — use compressed blobs if the server supports compressed blobs and the size is bigger than this. specify 0 to disable blob-level compression.
-reapi_digest_function=sha256 — content digest function: sha256, sha1, gitsha1, blake3, md5, sha384, sha512, murmur3, vso, or sha256tree.
-reapi_enable_grpc_compression=false — enable grpc compression. if enabled, blob-level compression will be forcibly disabled.
-reapi_grpc_conn_pool=25 — grpc connection pool.
-reapi_grpc_keepalive_permit_without_stream=false — grpc keepalive permit without stream.
-reapi_grpc_keepalive_time=30s — grpc keepalive time.
-reapi_grpc_keepalive_timeout=20s — grpc keepalive timeout.
-reapi_insecure=false — reapi insecure mode. default can be set by $RBE_service_no_security.
-reapi_instance=default_instance — reapi instance name. (for Google RBE: if instance is fully qualified (starts with projects/), project ID is inferred from it. otherwise, project ID from -project (or $SISO_PROJECT) is used to construct the instance name. if both are provided, -project is used for other cloud services.)
-reapi_keep_exec_stream=false — keep Execute stream open as long as possible.
-reapi_max_retries=10 — max retries for remote execution.
-reapi_priority=0 — reapi priority for action executions. the semantics and supported values depend on the backend.
-reapi_tls_ca_cert — load TLS CA certificates from this file to connect to the RE api service. default can be set by $RBE_tls_ca_cert.
-reapi_tls_client_auth_cert — certificate to use when using mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_cert.
-reapi_tls_client_auth_key — key to use when using mTLS to connect to the RE api service. default can be set by $RBE_tls_client_auth_key.
-reapi_trace_cookie — if set, sent as the cookie gRPC metadata header on every RPC to this backend, to force server-side trace sampling (e.g. Dapper).
-reapi_version_to_use — specify re api version to use, in format of v<major>.<minor>. e.g. v2.0.

🪪 `login` — login to siso system

🚪 `logout` — logout from siso system

logout from siso system. bye babes! 👋

🐛 DEBUGGING 🐛

🧵 `ninjafrontend` — ninjafrontend reader

ninjafrontend reader. parses the ninjafrontend proto. 🔬

$ siso ninja -frontend_file=- .. | siso ninjafrontend -template '...'

e.g. show message only:

--template='{{- with .Message}}{{with .Message}}{{.}}{{end}}{{end}}'

show edge output only:

--template='{{- with .EdgeFinished}}{{with .Output}}{{.}}{{end}}{{end}}'

see the proto definition:

https://chromium.googlesource.com/infra/infra/go/src/infra/+/refs/heads/main/build/siso/toolsupport/soongutil/proto/frontend.proto

see template syntax: https://pkg.go.dev/text/template

flags:

-template={{.}} — template for frontend.Status message. 🧚

📦 `sandbox` — run in sandbox

run in sandbox. 🏖️

$ siso sandbox -nsjail '<json nsjail request>' -- args ...

you can manually construct the json string of go.chromium.org/build/siso/toolsupport/nsjail.Request.

flags:

-C=. — ninja running directory (chdir before run).
-cleanup=true — cleanup sandbox after execution.
-config_repo_dir=build/config/siso — config repo directory (relative to the workspace).
-fs_defer_digest=false — defer digest calculation.
-fs_digest_xattr — xattr for sha256 digest; empty enables the default on Cog/CartFS only.
-fs_keep_tainted=false — keep manually modified generated file.
-fs_min_flush_timeout=30s — minimum timeout for flush. ignored if it's shorter than 10s.
-fs_state=.siso_fs_state — fs state filename.
-fs_state_compression_level=1 — fs state compression level (1 = fastest, 10 = best). 🏃‍♀️
-fs_state_compression_threads=8 — number of threads to use for data compression.
-fs_state_mmap=true — use memory-mapped I/O for state file reads/writes.
-nsjail — json format of nsjail request. 🔒

🔎 `scandeps` — run scandeps

run scandeps. 🕵️

...and the scandeps examples keep going, bestie, no cap:

$ siso scandeps -C <dir> -req '<json scandeps request>'
$ siso scandeps -C <dir> -target <build target name>
$ siso scandeps -C <dir> -- <command line>

That <json scandeps request>? Iconic shortcut alert 💖 you can find it sitting right there in the siso.INFO log, under "scandeps failed Request" — literally just copy-and-paste the json string straight out of the log. Chef's kiss. Or, if you're feeling main character energy, you can manually construct the json string of infra/build/siso/scandeps.Request. Your call, gorgeous 🫶

And the flags for this one:

-C=. — the ninja running directory (chdir happens before it runs)
-config_repo_dir=build/config/siso — config repo directory (and yeah, it's relative to the workspace)
-req — json format of a scandeps request
-state_dir=. — state directory (relative to -C, so pay attention ✨)
-target — build target name

🛠️ INTERNAL-HELPER

These are the behind-the-scenes girlies. They do the work so you don't have to 💅

`man`

generates a man page for siso

man [-out <file>]:
  Generates a man page for siso and its subcommands in troff
format.

So it manifests a whole man page, in troff format, for siso and all its subcommands. Meta, right? 🦋

Flags:

-out — output file path (default is stdout, so if you don't say anything it just yeets it at you)

`spawn-helper`

internal: fork/exec server for local actions

It's an internal helper that spawns local build actions on behalf of siso. 🐣

Real talk: users do not run this directly, okay? No cap. siso launches it automatically for local actions, specifically so it doesn't have to fork() its big ol' large heap. She's efficient like that 😌

Flags:

-conn_fd=0 — inherited socketpair fd to serve the spawn protocol on
-log_file — file for the helper's diagnostics (default: stderr)

📖 COMMAND-HELP

`flags`

describe all known top-level flags

flags [<subcommand>]:

With an argument, print all flags of that <subcommand>. Else, print a description of all known top-level flags. (And bestie, heads up: the basic help information only discusses the most generally important top-level flags. So flags is the full tea ☕)

`help`

describe subcommands and their syntax

help [<subcommand>]:

With an argument, it prints detailed information on the use of the specified subcommand. With no argument, print a list of all commands and a brief description of each. It's giving ✨directory of everything✨

`version`

prints the executable version

Prints the executable version and the CIPD package the executable was installed from (if it was installed via CIPD, obviously — if it wasn't, don't expect it to manifest out of thin air 💀).

Flags:

-cipd_url — show version info for this cipd URL.
-online=true — get information from CIPD and Git repo.

🌍 ENVIRONMENT

All the little env vars that can secretly be your bestie or your villain, depending on the day:

SISO_CREDENTIAL_HELPER — sets the default value of -credential_helper. It specifies a path to a credential helper program. See https://github.com/EngFlow/credential-helper-spec/blob/main/spec.md
SISO_PROJECT — sets the default value of --project, to specify Google Cloud Project.
SISO_REAPI_INSTANCE — sets the default value of -reapi_instance, to specify RE API instance name.
SISO_REAPI_ADDRESS — sets the default value of -reapi_address, to specify RE API service address.
SISO_REAPI_CAS_ADDRESS — sets the default value of -reapi_cas_address, to specify RE API content addressable storage service address.
SISO_LIMITS — can control siso's resource semaphore. Comma separated key value pairs in the form of key=value.
- step: maximum number of concurrent steps.
- preproc: maximum number of concurrent preprocesses.
- scandeps: maximum number of concurrent scandeps.
- local: maximum number of concurrent local executions.
- fastlocal: maximum number of local executions when local is idle even if step is remote executable.
- startlocal: maximum initial steps to run locally even if step is remote executable.
- remote: maximum number of concurrent remote executions.
- rewrap: maximum number of concurrent use_remote_exec_wrapper steps.
- cache: maximum number of concurrent exec cache lookups.
- thread: maximum number of threads.
- e.g. SISO_LIMITS=local=10,remote=100
SISO_FSMONITOR — a path of file system monitoring tool. Currently watchman is supported. (experimental).
SISO_EXPERIMENTS — comma separated feature names.
SISO_BUILD_ID — sets the default value of --build_id, to identify the build process. Used for tool_invocation_id of remote apis, and build_id label of Cloud logging resources.
SISO_COLLECTOR_ADDRESS — sets the default value of --collector_address.
NO_COLOR — disable colored text output. See https://no-color.org/ (sad, but valid 🙈)
TERM — used to detect smart terminal. "dumb" or "dumb-emacs-ansi" are not smart terminal.
RBE_service_no_security — sets the default value of -reapi_insecure, when using RE API with no authentication. (reclient compat)
RBE_tls_client_auth_cert, RBE_tls_client_auth_key — sets the default values of -reapi_tls_client_auth_cert and -reapi_tls_client_auth_key, when to use mTLS authentication. (reclient compat)
RBE_tls_ca_cert — sets the default value of -reapi_tls_ca_cert to specify Root CA Certificates file. (reclient compat)
NINJA_CORE_MULTIPLIER, NINJA_CORE_LIMIT — used to define default of rewrap's limit. (reclient compat)
RBE_remote_disabled — used to decide offline mode or not. (reclient compat)
RBE_metrics_project — sets the default value of -metrics_project, to specify Google Cloud Project for cloud monitoring. (reclient compat)
RBE_metrics_labels — sets the default value of -metrics_labels, which is comma separated arbitrary key value pairs in the form key=value to be added for cloud monitoring metrics. (reclient compat)

🐧 DEBIAN-SPECIFIC NOTES

Okay so the Debian package is not identical to the upstream CIPD-distributed binary — it differs in two ways, and we're being fully transparent about it because that's the vibe 🌈

Removed: OTel Collector subcommand

The collector subcommand (an internal-helper for Google's metrics infrastructure) is not included. It requires 84 Go modules not packaged in Debian and is only useful within Google Cloud infrastructure.

Removed: Direct Google Cloud Monitoring export

The direct export to Google Cloud Monitoring is not available. Build metrics can still be exported to any OpenTelemetry-compatible collector using the --collector_address flag with the ninja subcommand. This is the standard, vendor-neutral approach to metrics collection and works with Grafana, Jaeger, Prometheus, and other OTLP-compatible tools. ✨

Good news though: all core functionality (Ninja-compatible builds, local execution, Remote Build Execution via RBE, Starlark configuration) is fully preserved. She ate and left no crumbs 💅

👀 SEE ALSO

ninja(1)

Full documentation is available at https://chromium.googlesource.com/build/+/refs/heads/main/siso/ 🌸

💖 AUTHORS

The Chromium Authors.

And that's a wrap, bestie! 🎀 This whole page is the Siso Manual, page SISO(1) — from the source at https://chromium.googlesource.com/build/+/refs/heads/main/siso/. Go build something iconic with it 🦋✨💜

📦 where this page comes from

ubuntu stonking: siso 1.5.22+ds-1 · BSD-3-Clause
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-02: a language model's rewrite of the original, under its terms

SISO(1)

💅 siso — SISO(1) 💅

🎀 NAME 🎀

✨ SYNOPSIS ✨

🦋 DESCRIPTION 🦋

🌈 GLOBAL FLAGS 🌈

🧚 SUBCOMMANDS 🧚

👑 MAIN COMMANDS 👑

🥷 ninja — build the requested targets as ninja

🌈 REAPI 🌈

🦋 fetch — fetch contents

🧚 isolate — isolate uploads and computes tree digests

🧚 proxy — proxy RE-API service

✨ Flags ✨

🦋 recall — recall action

✨ Flags ✨

✨ INVESTIGATION ✨

🔍 fs — command group to access siso hashfs data

📊 metrics — command group to analyze siso_metrics.json

👀 ps — display running steps of ninja build

🧐 query — command group to query ninja build graph

📝 report — report siso logs

🌐 webui — starts the experimental webui

🔐 AUTH 🔐

✅ auth-check — prints current auth status

🪪 login — login to siso system

🚪 logout — logout from siso system

🐛 DEBUGGING 🐛

🧵 ninjafrontend — ninjafrontend reader

📦 sandbox — run in sandbox

🔎 scandeps — run scandeps

🛠️ INTERNAL-HELPER

man

spawn-helper

📖 COMMAND-HELP

flags

help

version

🌍 ENVIRONMENT

🐧 DEBIAN-SPECIFIC NOTES

👀 SEE ALSO

💖 AUTHORS

🥷 `ninja` — build the requested targets as ninja

🧚 `proxy` — proxy RE-API service

🦋 `recall` — recall action

🔍 `fs` — command group to access siso hashfs data

📊 `metrics` — command group to analyze siso_metrics.json

👀 `ps` — display running steps of ninja build

🧐 `query` — command group to query ninja build graph

📝 `report` — report siso logs

🌐 `webui` — starts the experimental webui

✅ `auth-check` — prints current auth status

🪪 `login` — login to siso system

🚪 `logout` — logout from siso system

🧵 `ninjafrontend` — ninjafrontend reader

📦 `sandbox` — run in sandbox

🔎 `scandeps` — run scandeps

`man`

`spawn-helper`

`flags`

`help`

`version`