Well: "fossil set mtime-changes on" reduces the update time to 19.5 seconds (!).  So I guess this isn't a real problem, though perhaps it should be documented as an optimization?

With 'mtime-changes' off, gprof indicates:

<pre>
  %   cumulative   self              self     total
 time   seconds   seconds    calls   s/call   s/call  name
 65.45     79.69    79.69 52540564     0.00     0.00  SHA1ProcessMessageBlock
 26.47    111.92    32.23   362862     0.00     0.00  SHA1Input
</pre>

Over 90% of the time is in these two routines ...