Index: src/cmd/go/internal/modfetch/fetch.go
--- src/cmd/go/internal/modfetch/fetch.go.orig	2021-02-16 21:58:06.466855000 +0100
+++ src/cmd/go/internal/modfetch/fetch.go	2021-02-16 21:58:38.727131000 +0100
@@ -149,9 +149,6 @@
 		return "", err
 	}
 
-	if !cfg.ModCacheRW {
-		makeDirsReadOnly(dir)
-	}
 	return dir, nil
 }
 
Index: src/crypto/x509/root_linux.go
--- src/crypto/x509/root_linux.go.orig	2021-02-16 19:12:04.000000000 +0100
+++ src/crypto/x509/root_linux.go	2021-02-16 22:00:34.468619000 +0100
@@ -6,18 +6,11 @@
 
 // Possible certificate files; stop after finding one.
 var certFiles = []string{
-	"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
-	"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
-	"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
-	"/etc/pki/tls/cacert.pem",                           // OpenELEC
-	"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
-	"/etc/ssl/cert.pem",                                 // Alpine Linux
+    "@l_prefix@/etc/x509/public-ca.crt.pem",
 }
 
 // Possible directories with certificate files; stop after successfully
 // reading at least one file from a directory.
 var certDirectories = []string{
-	"/etc/ssl/certs",               // SLES10/SLES11, https://golang.org/issue/12139
-	"/etc/pki/tls/certs",           // Fedora/RHEL
-	"/system/etc/security/cacerts", // Android
+    "@l_prefix@/etc/x509",
 }