Method load_verify_locations

crates/stdlib/src/ssl.rs:1229–1311

(
            &self,
            args: LoadVerifyLocationsArgs,
            vm: &VirtualMachine,
        )

        #[pymethod]
        fn load_verify_locations(
            &self,
            args: LoadVerifyLocationsArgs,
            vm: &VirtualMachine,
        ) -> PyResult<()> {
            // Check that at least one argument is provided
            let has_cafile = matches!(&args.cafile, OptionalArg::Present(Some(_)));
            let has_capath = matches!(&args.capath, OptionalArg::Present(Some(_)));
            let has_cadata = matches!(&args.cadata, OptionalArg::Present(Some(_)));

            if !has_cafile && !has_capath && !has_cadata {
                return Err(vm.new_type_error("cafile, capath and cadata cannot be all omitted"));
            }

            // Parse arguments BEFORE acquiring locks to reduce lock scope
            let cafile_path = if let OptionalArg::Present(Some(ref cafile_obj)) = args.cafile {
                Some(Self::parse_path_arg(cafile_obj, vm)?)
            } else {
                None
            };

            let capath_dir = if let OptionalArg::Present(Some(ref capath_obj)) = args.capath {
                Some(Self::parse_path_arg(capath_obj, vm)?)
            } else {
                None
            };

            let cadata_parsed = if let OptionalArg::Present(Some(ref cadata_obj)) = args.cadata {
                let is_string = matches!(cadata_obj, Either::A(_));
                let data_vec = self.parse_cadata_arg(cadata_obj, vm)?;
                Some((data_vec, is_string))
            } else {
                None
            };

            // Check for CRL before acquiring main locks
            let (crl_opt, cafile_is_crl) = if let Some(ref path) = cafile_path {
                let crl = self.load_crl_from_file(path, vm)?;
                let is_crl = crl.is_some();
                (crl, is_crl)
            } else {
                (None, false)
            };

            // If it's a CRL, just add it (separate lock, no conflict with root_store)
            if let Some(crl) = crl_opt {
                self.crls.write().push(crl);
            }

            // Now acquire write locks for certificate loading
            let mut root_store = self.root_certs.write();
            let mut ca_certs_der = self.ca_certs_der.write();

            // Load from file (if not CRL)
            if let Some(ref path) = cafile_path
                && !cafile_is_crl
            {
                // Not a CRL, load as certificate