Launch time Optimizations

Hello,

I've been using secretspecs for several months and am a very happy user, especially as far as features and stability is concerned.
There is one thing I've noticed though:
Startup time seems to have increased recently.

I've benchmarked this on Windows PowerShell.
A simple secretspec --version takes takes around 6.5 seconds (average of 20 runs).
This happens even if I run secretspec in a dir without secretspec.toml, so it doesn't load any secrets.

I wonder what causes this?
Are there maybe some ways to optimize this, e.g. do some initializations lazily only when they are needed?

Maybe some inspiration can be taken from other FOSS tools that are already optimized for launch time, such as ruff?

I ran a Windows startup comparison in CI using the exact published x86_64 Windows executables for 0.19.1 and 0.20.0, plus the current checkout of IPC PR #362.

The benchmark launched each executable by absolute path from an empty working directory with UseShellExecute = false. Measurements were interleaved over 50 warm launches on the GitHub Windows Server 2025 runner.

Executable	Size	First launch	Median	p95
v0.19.1	34.9 MB	45.2 ms	26.2 ms	56.1 ms
v0.20.0	43.0 MB	49.0 ms	24.7 ms	56.8 ms
IPC PR checkout	38.7 MB	32.2 ms	25.5 ms	55.3 ms

Run: https://github.com/cachix/secretspec/actions/runs/33815120939

CI therefore does not reproduce the 6.5-second startup. Although the v0.20 executable is 23% larger, its warm startup was not slower, and the upcoming IPC code caused no meaningful change. None of the CI files had Mark-of-the-Web metadata; all three executables were unsigned.

Could you share the SecretSpec version and install method, then run this in the same PowerShell session?

$exe = (Get-Command secretspec).Source
$exe
secretspec --version

1..20 | ForEach-Object {
    (Measure-Command { & $exe --version | Out-Null }).TotalMilliseconds
}

Get-Item -LiteralPath $exe -Stream Zone.Identifier -ErrorAction SilentlyContinue

Using & $exe bypasses repeated PowerShell command lookup. The final command tells us whether the downloaded executable still carries quarantine metadata. If absolute-path launches remain around 6.5 seconds, the next useful trace would be Windows Performance Recorder or Process Monitor to identify antivirus/filesystem activity during process startup.

I've currently installed secretspec 0.20.0 with WinGet, I'm pretty sure cargbo-binstall also had a high startup time.

The Output of the command is this:

Thie final command only outputs something if I remove the -ErrorAction SilentlyContinue part:

FullyQualifiedErrorId : AlternateDataStreamNotFound,Microsoft.PowerShell.Commands.GetItemCommand

Regarding using additional Tools to debug this:
I don't have admin permissions on this machine, so I can only contribute if they are not required.

Update:
I'm still on the same version of secretspec and didn't really change anything (apart from maybe some automatic OS updates).
Yet launch time is now way better, in the milliseconds, even in the same project. Without any changes.
I can't really explain this, maybe it is something about the quarantine you mentioned?

Would be great if someone on windows could debug this, I cannot reproduce it.

JetBrains recently released a Tool to debug Defender issues, if this happens again I'll ask someone from IT to install it so I can debug this further.

I'm going to close this for now, if it happens again please reopen and ask coding agents to debug it so we can fix it.

Navigation Menu

Repository navigation

Launch time Optimizations #427

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Launch time Optimizations #427

Description

Activity

domenkozar commented on Sep 3, 2026

GreenBean26 commented on Sep 4, 2026

GreenBean26 commented on Sep 4, 2026

GreenBean26 commented on Sep 8, 2026

domenkozar commented on Sep 13, 2026

raayu83 commented on Sep 13, 2026

domenkozar commented on Sep 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions