Index: src/cmd/go/internal/modfetch/fetch.go
--- src/cmd/go/internal/modfetch/fetch.go.orig	2024-02-02 19:09:55.000000000 +0100
+++ src/cmd/go/internal/modfetch/fetch.go	2024-02-07 22:50:45.247487000 +0100
@@ -162,9 +162,6 @@
 		return "", err
 	}
 
-	if !cfg.ModCacheRW {
-		makeDirsReadOnly(dir)
-	}
 	return dir, nil
 }
 
Index: src/crypto/x509/root_bsd.go
--- src/crypto/x509/root_bsd.go.orig	2024-02-02 19:09:55.000000000 +0100
+++ src/crypto/x509/root_bsd.go	2024-02-07 22:50:45.247572000 +0100
@@ -8,15 +8,10 @@
 
 // Possible certificate files; stop after finding one.
 var certFiles = []string{
-	"/usr/local/etc/ssl/cert.pem",            // FreeBSD
-	"/etc/ssl/cert.pem",                      // OpenBSD
-	"/usr/local/share/certs/ca-root-nss.crt", // DragonFly
-	"/etc/openssl/certs/ca-certificates.crt", // NetBSD
+    "@l_prefix@/etc/x509/public-ca.crt.pem",
 }
 
 // Possible directories with certificate files; all will be read.
 var certDirectories = []string{
-	"/etc/ssl/certs",         // FreeBSD 12.2+
-	"/usr/local/share/certs", // FreeBSD
-	"/etc/openssl/certs",     // NetBSD
+    "@l_prefix@/etc/x509",
 }
Index: src/crypto/x509/root_linux.go
--- src/crypto/x509/root_linux.go.orig	2024-02-07 22:50:45.247653000 +0100
+++ src/crypto/x509/root_linux.go	2024-02-07 22:54:05.211555000 +0100
@@ -8,25 +8,13 @@
 
 // Possible certificate files; stop after finding one.
 var certFiles = []string{
-	"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
-	"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
-	"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
-	"/etc/pki/tls/cacert.pem",                           // OpenELEC
-	"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
-	"/etc/ssl/cert.pem",                                 // Alpine Linux
+    "@l_prefix@/etc/x509/public-ca.crt.pem",
 }
 
 // Possible directories with certificate files; all will be read.
 var certDirectories = []string{
-	"/etc/ssl/certs",     // SLES10/SLES11, https://golang.org/issue/12139
-	"/etc/pki/tls/certs", // Fedora/RHEL
+    "@l_prefix@/etc/x509",
 }
 
 func init() {
-	if goos.IsAndroid == 1 {
-		certDirectories = append(certDirectories,
-			"/system/etc/security/cacerts",    // Android system roots
-			"/data/misc/keychain/certs-added", // User trusted CA folder
-		)
-	}
 }