rustfmt takes too long to install

[KnotUntied]

Verification

• I searched for recent similar issues at https://github.com/rust-lang/rustup/issues?q=is%3Aissue+is%3Aopen%2Cclosed and found no duplicates.
• I am on the latest version of Rustup according to https://github.com/rust-lang/rustup/tags and am still able to reproduce my issue.

Problem

Whenever I update my toolchain using rustup update, rustfmt seems to take an abnormally long time to install, i.e., info: installing component 'rustfmt' takes several minutes. Listed below are for the most recent instance.

Steps

Either run rustup component add rustfmt or rustup update while rustfmt is installed in the latter case.

Possible Solution(s)

No response

Notes

I've seen a similar anecdote on Discord, albeit on macOS, which suspected Microsoft Defender as the culprit but I'm not sure on this one.

Rustup version

rustup 1.28.1 (f9edccde0 2025-03-05)

Installed toolchains

Default host: x86_64-pc-windows-msvc
rustup home:  D:\scoop\persist\rustup-msvc\.rustup

installed toolchains
--------------------
stable-x86_64-pc-windows-gnu
stable-x86_64-pc-windows-msvc (active, default)

active toolchain
----------------
name: stable-x86_64-pc-windows-msvc
active because: it's the default toolchain
installed targets:
  x86_64-pc-windows-gnu
  x86_64-pc-windows-msvc

OS version

Windows 10 22H2

[ChrisDenton]

A new rust release tends to mean we get an increase in anti-malware related issues for a week or so until they stop seeing rust tools as potential viruses.

We're not aware of a fix (ideas welcome!) other than waiting for those anti-malware applications to start trusting the rust files again. Even if we figure out how to appease them this time, there's no guarantee it'll work next time. In the future this may get better when we have code signing across the project but we don't have the infrastructure for that yet.

A workaround may be to exclude the rustup directory from automated anti-malware scans. But I can understand that people either can't or don't want to do that.