Index: src/cmd/go/internal/modfetch/fetch.go
--- src/cmd/go/internal/modfetch/fetch.go.orig	2021-08-16 18:29:54.000000000 +0200
+++ src/cmd/go/internal/modfetch/fetch.go	2021-08-28 00:16:42.781024000 +0200
@@ -149,9 +149,6 @@
 		return "", err
 	}
 
-	if !cfg.ModCacheRW {
-		makeDirsReadOnly(dir)
-	}
 	return dir, nil
 }
 
Index: src/crypto/x509/root_bsd.go
--- src/crypto/x509/root_bsd.go.orig	2021-08-28 00:16:42.781227000 +0200
+++ src/crypto/x509/root_bsd.go	2021-08-28 00:26:54.494240000 +0200
@@ -9,16 +9,11 @@
 
 // Possible certificate files; stop after finding one.
 var certFiles = []string{
-	"/usr/local/etc/ssl/cert.pem",            // FreeBSD
-	"/etc/ssl/cert.pem",                      // OpenBSD
-	"/usr/local/share/certs/ca-root-nss.crt", // DragonFly
-	"/etc/openssl/certs/ca-certificates.crt", // NetBSD
+    "@l_prefix@/etc/x509/public-ca.crt.pem",
 }
 
 // Possible directories with certificate files; stop after successfully
 // reading at least one file from a directory.
 var certDirectories = []string{
-	"/etc/ssl/certs",         // FreeBSD 12.2+
-	"/usr/local/share/certs", // FreeBSD
-	"/etc/openssl/certs",     // NetBSD
+    "@l_prefix@/etc/x509",
 }
Index: src/crypto/x509/root_linux.go
--- src/crypto/x509/root_linux.go.orig	2021-08-16 18:29:54.000000000 +0200
+++ src/crypto/x509/root_linux.go	2021-08-28 00:16:42.781441000 +0200
@@ -6,18 +6,11 @@
 
 // Possible certificate files; stop after finding one.
 var certFiles = []string{
-	"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
-	"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
-	"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
-	"/etc/pki/tls/cacert.pem",                           // OpenELEC
-	"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
-	"/etc/ssl/cert.pem",                                 // Alpine Linux
+    "@l_prefix@/etc/x509/public-ca.crt.pem",
 }
 
 // Possible directories with certificate files; stop after successfully
 // reading at least one file from a directory.
 var certDirectories = []string{
-	"/etc/ssl/certs",               // SLES10/SLES11, https://golang.org/issue/12139
-	"/etc/pki/tls/certs",           // Fedora/RHEL
-	"/system/etc/security/cacerts", // Android
+    "@l_prefix@/etc/x509",
 }