go/src/crypto/x509/root_unix.go

const certFileEnv …

const certDirEnv …

func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate, err error) { … }

func loadSystemRoots() (*CertPool, error) { … }

// readUniqueDirectoryEntries is like os.ReadDir but omits
// symlinks that point within the directory.
func readUniqueDirectoryEntries(dir string) ([]fs.DirEntry, error) { … }

// isSameDirSymlink reports whether fi in dir is a symlink with a
// target not containing a slash.
func isSameDirSymlink(f fs.DirEntry, dir string) bool { … }