Chezmoi slowed down over past few months

[pbogut]

Describe the bug

Chezmoi slowed down significantly over past year, but mostly since the 50f9884 commit.

To reproduce

Run \time -f %es chezmoi --version or smimillar to track time.

Expected behavior

Application prints output quickly (ideally 0.01s)

Actual behavior

Currently it takes 0.26s to print version.

Output of chezmoi doctor

$ chezmoi doctor

RESULT CHECK MESSAGE
warning version dev
warning latest-version v2.60.1
ok os-arch linux/amd64 (Arch Linux)
ok uname Linux redeye 6.13.6-arch1-1 #1 SMP PREEMPT_DYNAMIC Fri, 07 Mar 2025 20:19:00 +0000 x86_64 GNU/Linux
ok go-version go1.24.1 (gc)
ok executable /storage/projects/github.com/twpayne/chezmoi/master/chezmoi
ok upgrade-method replace-executable
ok config-file found ~/.config/chezmoi/chezmoi.toml, last modified 2025-03-16T11:01:06+01:00
warning source-dir ~/.local/share/chezmoi is a git working tree (dirty)
ok suspicious-entries no suspicious entries
warning working-tree ~/.local/share/chezmoi is a git working tree (dirty)
ok dest-dir ~ is a directory
ok umask 022
ok cd-command found /usr/bin/zsh
ok cd-args /usr/bin/zsh
info diff-command not set
ok edit-command found /usr/bin/nvim
ok edit-args /usr/bin/nvim
ok git-command found /usr/bin/git, version 2.48.1
ok merge-command found /usr/bin/vimdiff
ok shell-command found /usr/bin/zsh
ok shell-args /usr/bin/zsh
ok age-command found /usr/bin/age, version 1.2.1
ok gpg-command found /usr/bin/gpg, version 2.4.7
info pinentry-command not set
info 1password-command op not found in $PATH
ok bitwarden-command found /usr/bin/bw, version 2025.1.3
info bitwarden-secrets-command bws not found in $PATH
info dashlane-command dcli not found in $PATH
info doppler-command doppler not found in $PATH
info gopass-command gopass not found in $PATH
ok keepassxc-command found /usr/bin/keepassxc-cli, version 2.7.10
info keepassxc-db not set
info keeper-command keeper not found in $PATH
info lastpass-command lpass not found in $PATH
ok pass-command found /usr/bin/pass, version 1.7.4
info passhole-command ph not found in $PATH
ok rbw-command found ~/.cargo/bin/rbw, version 1.12.1
info vault-command vault not found in $PATH
info vlt-command vlt not found in $PATH
ok secret-command found ~/.scripts/secret

Additional context

Using git's bisect I found out that the biggest slowdown happened between 707dc20 and 50f9884 commits.

50f988401 - 0.21s
707dc200e - 0.04s

I've also checked what was updated then, and looks like the slowdown happened with gitleaks update.

If you try to run \time %es chezmoi --version on current master it takes 0.23s to run,
after downgrading gitleaks with go get github.com/zricethezav/gitleaks/v8@v8.21.4 run time is 0.06s.

It used to run within 0.01s, but 0.06s is not bad. Not sure what gitleaks does to slow it down 4 times, and why its doing anything when running simple commands like --version.

[twpayne]

Thank you so much for spotting this regression and for your work in bisecting the offending commit and package. I confirm that I see the exact same behavior on my machine and will investigate further.

[twpayne]

The bad commit in gitleaks is gitleaks/gitleaks@a91c671. I'll open an issue there.

[twpayne]

I've opened gitleaks/gitleaks#1796. Thanks again!

[twpayne]

#4357 fixes this by switching the regexp package used by gitleaks from go-re2 (which was taking 160ms of startup time) to the standard regexp package (which has no start-up time).

With these changes, chezmoi --version now takes about 50ms instead of 200ms, which is not perfect, but is a significant improvement.

[twpayne]

Thanks again @pbogut for reporting this! I ended up giving a talk at the Zürich Gophers Meetup about how I investigated and fixed the problem.

Since the talk, I did a bit more investigating and have shaved another 25ms off chezmoi's start up time. Quick tl;dr:

• chezmoi links in github.com/gopasspw/gopass.
• github.com/gopasspw/gopass depends on github.com/nbutton23/zxcvbn-go.
• github.com/nbutton23/zxcvbn-go spends 25ms computing data in unavoidable init functions.
• github.com/nbutton23/zxcvbn-go is unmaintained.
• I reported this as Performance: Use of github.com/nbutton23/zxcvbn-go adds ~25ms of latency to every run gopasspw/gopass#3132.
• gopass removed its dependency on github.com/nbutton23/zxcvbn-go in [feat] Remove expensive and unmaintained zxcvbn-go strength checker gopasspw/gopass#3133.

The net result of this is that the next version chezmoi should have a startup time of around 10ms, about 20x faster than when you opened this issue. You were right that chezmoi was slow!

[twpayne]

I hope to remove another 8ms of start-up time with https://groups.google.com/g/golang-nuts/c/OhGLRmYC8iI.