The major programs are Mozilla's (NSS certdata.txt, reused by most Linux distributions, certifi for Python and many container images), Apple's, Microsoft's and the Chrome Root Store, which Chrome has used instead of the platform store on most platforms since version 105 (2022). Java ships its own cacerts, Node.js bundles Mozilla's list (and can use the system store with --use-system-ca), and Go uses the platform store.
Root programs set requirements beyond the CA/Browser Forum's: Certificate Transparency policies, term limits for roots, dedicated single-purpose hierarchies, incident reporting, and the power to distrust a CA, sometimes only for certificates issued after a cut-off date. CCADB is the shared database where CAs disclose their hierarchies.
Practical consequences: a container built from an old image may lack a new root, enterprise TLS interception works by adding a private root to the store, and the same certificate can be trusted by one client and rejected by another.