CL 799801: crypto/x509: defer directory scan when cert bundle provides roots Body:

[Naman Trivedi]

Hi,

I've submitted CL 799801 (https://go-review.googlesource.com/c/go/+/799801) implementing the optimization proposed in #38869 by by Filippo Valsorda — deferring the default cert directory scan when a bundle file already provides roots.

On Fedora/RHEL/AL2023 systems with full CPU, this reduces cert loading from ~12ms to ~3ms (75%). On CPU-constrained containers (e.g. 128MB with 0.08 vCPU), the same redundant scan costs ~820ms — first TLS call drops from ~1510ms to ~398ms (74%). The design follows OpenSSL's CAfile-first, CApath-on-demand approach.

Would appreciate a review when someone has a chance. Happy to address any feedback.

Thanks, Naman