The handling of group file changes via the -G option is abysmal.
It creates a new copy of the installed group file on every group line
changed, fsync'ing after the new copy is made. On top of that, it implements
a new group list by first removing the user from all existing groups and then
reading them to every group in the new list, thereby maximizing the number of
group lines changed!

On the Emulab mothership where, for example, the "geniuser" user is in
some 450+ groups, adding them to a new group entailed changing 450+ lines
twice, resulting in over 900 copies of the 2000 line group file being
written. This took about 17 minutes.

The change here is modest, just check where the group line needs to be
changed or not before doing anything. In the case above, adding a single
group for a user, we only write the group file once. This takes about 0.8
seconds.