packages: Add a base-jail set

This is base, but without packages which are not generally useful
in jails.  The following packages are excluded:

* Support for hardware not present in a jail:
  acpi, apm, bluetooth, ccdconfig, console-tools, cxgbe-tools,
  efi-tools, fd, hostapd, mlx-tools, nvme-tools, wpa

* Kernel facilities that don't work in a jail:
  dtrace, dwatch, ggate, hast, iscsi, libcuse, smbutils

All library packages are included in base-jail, even if they might not
work, because the user may have executables linked with them.

While here, remove the set-minimal dependency from set-devel, since
this will cause unnecessary packages to be installed in jails.  This
means users will need to install set-devel in addition to their base
set (minimal or base), which bsdinstall already handles correctly.

Add a license to all the set UCL files, so people can redistribute them.

MFC after:	6 hours
Reviewed by:	manu
Differential Revision:	https://reviews.freebsd.org/D52719

88 files changed, 611 insertions, 14 deletions

diff --git a/release/packages/sets/base-dbg.ucl b/release/packages/sets/base-dbg.ucl
index c34e8b575834..d9eeb2c49677 100644
--- a/release/packages/sets/base-dbg.ucl
+++ b/release/packages/sets/base-dbg.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Base system debug symbols (metapackage)"
 
 desc = <<EOD
diff --git a/release/packages/sets/base-jail-dbg.ucl b/release/packages/sets/base-jail-dbg.ucl
new file mode 100644
index 000000000000..7996b9afbb21
--- /dev/null
+++ b/release/packages/sets/base-jail-dbg.ucl
@@ -0,0 +1,34 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Base jail system debug symbols (metapackage)"
+
+desc = <<EOD
+This metapackage installs debugging symbols for the base jail system.
+EOD
+
+deps {
+	"set-minimal-jail-dbg" {
+		version = "${VERSION}"
+		origin = "base"
+	},
+	"set-devel-dbg" {
+		version = "${VERSION}"
+		origin = "base"
+	}
+}
diff --git a/release/packages/sets/base-jail.ucl b/release/packages/sets/base-jail.ucl
new file mode 100644
index 000000000000..e6c52349d3cb
--- /dev/null
+++ b/release/packages/sets/base-jail.ucl
@@ -0,0 +1,37 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Base jail system (metapackage)"
+
+vital = true
+
+desc = <<EOD
+This metapackage installs the complete base system, excluding packages which
+are not generally useful in a jail(8) environment.
+EOD
+
+deps {
+	"set-minimal-jail" {
+		version = "${VERSION}"
+		origin = "base"
+	},
+	"set-devel" {
+		version = "${VERSION}"
+		origin = "base"
+	}
+}
diff --git a/release/packages/sets/base.ucl b/release/packages/sets/base.ucl
index 2d94ff4f4f2e..7b86450ae5b2 100644
--- a/release/packages/sets/base.ucl
+++ b/release/packages/sets/base.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Base system (metapackage)"
 
 vital = true
diff --git a/release/packages/sets/devel-dbg.ucl b/release/packages/sets/devel-dbg.ucl
index c3fcd9806272..f454bd1d634d 100644
--- a/release/packages/sets/devel-dbg.ucl
+++ b/release/packages/sets/devel-dbg.ucl
@@ -1,13 +1,24 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Development tools debugging symbols (metapackage)"
 
 desc = <<EOD
 This metapackage installs debugging symbols for the base system compiler and
 toolchain.
 EOD
-
-deps {
-	"set-minimal-dbg" {
-		version = "${VERSION}"
-		origin = "base"
-	},
-}
diff --git a/release/packages/sets/devel.ucl b/release/packages/sets/devel.ucl
index 08914a85a5b4..befa9a6e2e4c 100644
--- a/release/packages/sets/devel.ucl
+++ b/release/packages/sets/devel.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Development tools (metapackage)"
 
 vital = true
@@ -6,10 +24,3 @@ desc = <<EOD
 This metapackage installs development support for the base system, including
 compilers, toolchain utilities, header files, and static libraries.
 EOD
-
-deps {
-	"set-minimal" {
-		version = "${VERSION}"
-		origin = "base"
-	},
-}
diff --git a/release/packages/sets/kernels-dbg.ucl b/release/packages/sets/kernels-dbg.ucl
index cf789c29d35a..ecc775a99e08 100644
--- a/release/packages/sets/kernels-dbg.ucl
+++ b/release/packages/sets/kernels-dbg.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Base system kernels debugging symbols (metapackage)"
 
 desc = <<EOD
diff --git a/release/packages/sets/kernels.ucl b/release/packages/sets/kernels.ucl
index a57bd5f16905..04ecee83e291 100644
--- a/release/packages/sets/kernels.ucl
+++ b/release/packages/sets/kernels.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Base system kernels (metapackage)"
 
 desc = <<EOD
diff --git a/release/packages/sets/lib32-dbg.ucl b/release/packages/sets/lib32-dbg.ucl
index 12722510dc94..33d0b61b445c 100644
--- a/release/packages/sets/lib32-dbg.ucl
+++ b/release/packages/sets/lib32-dbg.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "32-bit compatibility library debugging symbols (metapackage)"
 
 desc = <<EOD
diff --git a/release/packages/sets/lib32.ucl b/release/packages/sets/lib32.ucl
index b23ae15d00ae..85263e2097c4 100644
--- a/release/packages/sets/lib32.ucl
+++ b/release/packages/sets/lib32.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "32-bit compatibility libraries (metapackage)"
 
 vital = true
diff --git a/release/packages/sets/minimal-dbg.ucl b/release/packages/sets/minimal-dbg.ucl
index 606394001696..aa2034c90548 100644
--- a/release/packages/sets/minimal-dbg.ucl
+++ b/release/packages/sets/minimal-dbg.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Basic multi-user system debugging symbols (metapackage)"
 
 desc = <<EOD
diff --git a/release/packages/sets/minimal-jail-dbg.ucl b/release/packages/sets/minimal-jail-dbg.ucl
index 3f7df227d3a9..1af963737f08 100644
--- a/release/packages/sets/minimal-jail-dbg.ucl
+++ b/release/packages/sets/minimal-jail-dbg.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Basic multi-user jail debugging symbols (metapackage)"
 
 desc = <<EOD
diff --git a/release/packages/sets/minimal-jail.ucl b/release/packages/sets/minimal-jail.ucl
index 04e71912898c..ad722e79bd7f 100644
--- a/release/packages/sets/minimal-jail.ucl
+++ b/release/packages/sets/minimal-jail.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Basic multi-user jail system (metapackage)"
 
 vital = true
diff --git a/release/packages/sets/minimal.ucl b/release/packages/sets/minimal.ucl
index f2338f4c2e3b..37e7df8e7e68 100644
--- a/release/packages/sets/minimal.ucl
+++ b/release/packages/sets/minimal.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "Basic multi-user system (metapackage)"
 
 vital = true
diff --git a/release/packages/sets/src.ucl b/release/packages/sets/src.ucl
index 7ab94eb420df..997335a19768 100644
--- a/release/packages/sets/src.ucl
+++ b/release/packages/sets/src.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "System source code"
 
 vital = yes
diff --git a/release/packages/sets/tests.ucl b/release/packages/sets/tests.ucl
index 07b463fb7d69..3829dae11b3e 100644
--- a/release/packages/sets/tests.ucl
+++ b/release/packages/sets/tests.ucl
@@ -1,3 +1,21 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 comment = "System test suite"
 
 vital = yes
diff --git a/release/packages/ucl/acct-all.ucl b/release/packages/ucl/acct-all.ucl
index a96e3cc08471..f4c7119af798 100644
--- a/release/packages/ucl/acct-all.ucl
+++ b/release/packages/ucl/acct-all.ucl
@@ -29,3 +29,7 @@ lastcomm(1) command to view this information.  However, system accounting
 is not intended as a security auditing mechanism; use the OpenBSM auditing
 system provided in the $PKG_NAME_PREFIX-audit package for that.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/atf-all.ucl b/release/packages/ucl/atf-all.ucl
index 4d4bf8b6b69b..3014163c95bd 100644
--- a/release/packages/ucl/atf-all.ucl
+++ b/release/packages/ucl/atf-all.ucl
@@ -33,3 +33,7 @@ test programs in a variety of languages.  These libraries all offer similar
 functionality and any test program written with them exposes a consistent user
 interface.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/audit-all.ucl b/release/packages/ucl/audit-all.ucl
index c7c437d24476..43074b3bf299 100644
--- a/release/packages/ucl/audit-all.ucl
+++ b/release/packages/ucl/audit-all.ucl
@@ -42,3 +42,7 @@ system.
 This packages provides the auditing daemon auditd(8) and various utilities
 used to manage the auditing system and work with audit data.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/autofs-all.ucl b/release/packages/ucl/autofs-all.ucl
index a51292e78faf..63261b9ce8d1 100644
--- a/release/packages/ucl/autofs-all.ucl
+++ b/release/packages/ucl/autofs-all.ucl
@@ -27,3 +27,7 @@ or to provide automated access to NFS servers via the /net mountpoint.
 This package provides the automountd(8) daemon which is responsible for
 managing this, as well as the management utility automount(8).
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/bhyve-all.ucl b/release/packages/ucl/bhyve-all.ucl
index ac250b0f2ad4..c4e450a47934 100644
--- a/release/packages/ucl/bhyve-all.ucl
+++ b/release/packages/ucl/bhyve-all.ucl
@@ -40,3 +40,7 @@ loader.
 An example script is also provided in /usr/share/examples/bhyve/vmrun.sh
 which can be used to run simple virtual machines.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/blocklist-all.ucl b/release/packages/ucl/blocklist-all.ucl
index 6acc6c548103..6e94b3822cf0 100644
--- a/release/packages/ucl/blocklist-all.ucl
+++ b/release/packages/ucl/blocklist-all.ucl
@@ -26,3 +26,7 @@ system packet filter.
 blacklistd(8) relies on each network daemon to report access attempts, so
 only daemons which have had blacklist support added will work.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/bsdconfig-all.ucl b/release/packages/ucl/bsdconfig-all.ucl
index ba34e5b96fe9..944dc0a259da 100644
--- a/release/packages/ucl/bsdconfig-all.ucl
+++ b/release/packages/ucl/bsdconfig-all.ucl
@@ -25,3 +25,7 @@ configuration, including services, networking and disks.
 This package also provides sysrc(8), a command-line utility for managing
 the rc.conf(5) configuration.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/bsdinstall-all.ucl b/release/packages/ucl/bsdinstall-all.ucl
index cfa303bc2ba4..2e01cbcb51ca 100644
--- a/release/packages/ucl/bsdinstall-all.ucl
+++ b/release/packages/ucl/bsdinstall-all.ucl
@@ -35,3 +35,7 @@ bsdinstall is used for installation of new systems, both for system setup from
 installation media, e.g., CD-ROMs, and for use on live systems to prepare VM
 images and jails.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/bsnmp-all.ucl b/release/packages/ucl/bsnmp-all.ucl
index 683b6ff51a53..88a777b3181d 100644
--- a/release/packages/ucl/bsnmp-all.ucl
+++ b/release/packages/ucl/bsnmp-all.ucl
@@ -40,3 +40,7 @@ Protocol).  It is intended to serve only the absolute basic MIBs and
 implement all other MIBs through loadable modules.  In this way the
 bsnmpd can be used in unexpected ways.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/csh-all.ucl b/release/packages/ucl/csh-all.ucl
index a158b5cd4fcb..787c43bdb82b 100644
--- a/release/packages/ucl/csh-all.ucl
+++ b/release/packages/ucl/csh-all.ucl
@@ -38,3 +38,7 @@ interactive login shell and a shell script command processor.  It includes
 a command-line editor, programmable word completion, spelling correction,
 a history mechanism, job control, and a C-like syntax.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/dma-all.ucl b/release/packages/ucl/dma-all.ucl
index 9abc83e8ee60..7b52c48a6def 100644
--- a/release/packages/ucl/dma-all.ucl
+++ b/release/packages/ucl/dma-all.ucl
@@ -46,3 +46,7 @@ systems, nor act as a mail exchanger for other hosts.  If an SMTP server
 is required, or when more advanced mail routing is needed, consider using
 the $PKG_NAME_PREFIX-sendmail package instead.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/ee-all.ucl b/release/packages/ucl/ee-all.ucl
index 2caa658c40f3..fbad921e7ef8 100644
--- a/release/packages/ucl/ee-all.ucl
+++ b/release/packages/ucl/ee-all.ucl
@@ -23,3 +23,7 @@ The Easy Editor, ee(1), is a simple, user-friendly text editor.  It provides
 a full-screen editing interface similar to vi(1), but is easier to learn for
 new users.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/examples-all.ucl b/release/packages/ucl/examples-all.ucl
index fe7ce1c461b4..027c65427924 100644
--- a/release/packages/ucl/examples-all.ucl
+++ b/release/packages/ucl/examples-all.ucl
@@ -24,3 +24,7 @@ The examples are provided as self-contained C source code.
 
 Some useful graphics data related to the "Beastie" mascot are also provided.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/ftp-all.ucl b/release/packages/ucl/ftp-all.ucl
index a8eac7b57946..285bf72529b5 100644
--- a/release/packages/ucl/ftp-all.ucl
+++ b/release/packages/ucl/ftp-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 The ftp(1) utility connects to a remote system implementing the Internet FTP
 protocol (RFC 959) to upload and download files.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/games-all.ucl b/release/packages/ucl/games-all.ucl
index a4636c32153a..80339ef6cdea 100644
--- a/release/packages/ucl/games-all.ucl
+++ b/release/packages/ucl/games-all.ucl
@@ -26,3 +26,7 @@ Games distributed with the system:
 * caesar(6) and rot13(6) implement a trivial (and easily broken) text
   encryption system called a Caesar cipher.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/gssd-all.ucl b/release/packages/ucl/gssd-all.ucl
index 60d976bfa82c..dfd2958d143e 100644
--- a/release/packages/ucl/gssd-all.ucl
+++ b/release/packages/ucl/gssd-all.ucl
@@ -28,3 +28,7 @@ to fetch authentication data such as Kerberos tickets from userland.
 
 This daemon is required when using Kerberos authentication with NFS.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/inetd-all.ucl b/release/packages/ucl/inetd-all.ucl
index bf70f8a7458d..be1e44fbaa3d 100644
--- a/release/packages/ucl/inetd-all.ucl
+++ b/release/packages/ucl/inetd-all.ucl
@@ -23,3 +23,7 @@ The inetd(8) server listens for incoming network connections and spawns a
 process to handle the connection based on its configuration file.  Some
 built-in servers for basic services are also provided.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/ipf-all.ucl b/release/packages/ucl/ipf-all.ucl
index 232495d0bd80..04a0a8ef7469 100644
--- a/release/packages/ucl/ipf-all.ucl
+++ b/release/packages/ucl/ipf-all.ucl
@@ -25,3 +25,7 @@ This package provides the rc(8) services and utilities used to manage the
 packet filter, and periodic(8) reports for filter activity.  Some examples
 of configuring IP Filter are also provided in /usr/share/examples/ipfilter.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/ipfw-all.ucl b/release/packages/ucl/ipfw-all.ucl
index e46a087f0685..4eec24194633 100644
--- a/release/packages/ucl/ipfw-all.ucl
+++ b/release/packages/ucl/ipfw-all.ucl
@@ -28,3 +28,7 @@ This package provides the ipfw(8) utility used to manage ipfw, periodic(8)
 reports on filter activity, and rc(8) services to automatically start ipfw
 at system startup.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/jail-all.ucl b/release/packages/ucl/jail-all.ucl
index 59b7a0c99828..6cd085581240 100644
--- a/release/packages/ucl/jail-all.ucl
+++ b/release/packages/ucl/jail-all.ucl
@@ -30,3 +30,7 @@ This package provides the jail(8), jexec(8) and jls(8) utilities for managing
 jails, and an optional rc(8) service to start jails during system startup using
 the /etc/jail.conf configuration file.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/kerberos-all.ucl b/release/packages/ucl/kerberos-all.ucl
index 2dfb8dc27b7f..a62be895e96d 100644
--- a/release/packages/ucl/kerberos-all.ucl
+++ b/release/packages/ucl/kerberos-all.ucl
@@ -32,3 +32,7 @@ applications to be integrated with Kerberos.
 This version of Kerberos implements version 5 of the Kerberos protocol,
 sometimes called Kerberos V.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/kerberos-kdc-all.ucl b/release/packages/ucl/kerberos-kdc-all.ucl
index fef5206055c8..7c2d412460ec 100644
--- a/release/packages/ucl/kerberos-kdc-all.ucl
+++ b/release/packages/ucl/kerberos-kdc-all.ucl
@@ -27,3 +27,7 @@ Unix systems, as well as many other platforms.
 This package provides the Kerberos key distribution center (KDC), which
 manages the Kerberos database and issues tickets to Kerberos users.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/kyua-all.ucl b/release/packages/ucl/kyua-all.ucl
index 2322ec95c455..e7a26de7ea6d 100644
--- a/release/packages/ucl/kyua-all.ucl
+++ b/release/packages/ucl/kyua-all.ucl
@@ -52,3 +52,7 @@ libraries and languages.  The test program library of choice is ATF, which
 kyua's design originated from.  However, framework-less test programs and
 TAP-compliant test programs can also be executed through kyua.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/lib9p-all.ucl b/release/packages/ucl/lib9p-all.ucl
index 6e48d373380f..9eb030bd7a0c 100644
--- a/release/packages/ucl/lib9p-all.ucl
+++ b/release/packages/ucl/lib9p-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 lib9p implements the server side of the 9p2000, 9p2000.u and 9p2000.L revisions
 of the 9P protocol.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libarchive-all.ucl b/release/packages/ucl/libarchive-all.ucl
index 8388fc916546..79a80b6a4c54 100644
--- a/release/packages/ucl/libarchive-all.ucl
+++ b/release/packages/ucl/libarchive-all.ucl
@@ -32,3 +32,7 @@ archives in various formats such as tar and cpio.  libarchive also supports
 reading and writing archives compressed using various compression filters
 such as gzip and bzip2.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libbegemot-all.ucl b/release/packages/ucl/libbegemot-all.ucl
index b9fa09ca6689..c1080de8f253 100644
--- a/release/packages/ucl/libbegemot-all.ucl
+++ b/release/packages/ucl/libbegemot-all.ucl
@@ -44,3 +44,7 @@ The rpoll(3) family of functions is designed to overcome these restrictions.
 They support the well known and understood technique of event driven programing
 and, in addition to select(2) and poll(2) also support timers.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libblocksruntime-all.ucl b/release/packages/ucl/libblocksruntime-all.ucl
index 129dac965a04..4b4085d9d0da 100644
--- a/release/packages/ucl/libblocksruntime-all.ucl
+++ b/release/packages/ucl/libblocksruntime-all.ucl
@@ -23,3 +23,7 @@ The BlocksRuntime library provides runtime support for Blocks, a
 non-standard extension to the C programming language which adds
 support for lambda expressions and closures.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libbsdstat-all.ucl b/release/packages/ucl/libbsdstat-all.ucl
index 1b677a125c88..acfb77fd6242 100644
--- a/release/packages/ucl/libbsdstat-all.ucl
+++ b/release/packages/ucl/libbsdstat-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libbsdstat is a library for managing and display periodically collected
 statistics.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libbsm-all.ucl b/release/packages/ucl/libbsm-all.ucl
index ee060f206890..76852b310e8f 100644
--- a/release/packages/ucl/libbsm-all.ucl
+++ b/release/packages/ucl/libbsm-all.ucl
@@ -34,3 +34,7 @@ The libbsm library routines provide an interface to BSM audit record streams,
 allowing both the parsing of existing audit streams, as well as the creation
 of new audit records and streams.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libcasper-all.ucl b/release/packages/ucl/libcasper-all.ucl
index 8d980987dffd..4f839ef6fc46 100644
--- a/release/packages/ucl/libcasper-all.ucl
+++ b/release/packages/ucl/libcasper-all.ucl
@@ -24,3 +24,7 @@ under the Capsicum capability-based security framework.  libcasper allows
 passing messages and capabilities between the sandboxed application and a
 helper process to allow restricted access to system and network resources.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libcompat-all.ucl b/release/packages/ucl/libcompat-all.ucl
index a150709d1bc6..1fb209f4cafc 100644
--- a/release/packages/ucl/libcompat-all.ucl
+++ b/release/packages/ucl/libcompat-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libcompat provides an implementation of some obsolete library functions:
 cuserid(3), re_comp(3), re_exec(3) and rexec(3).
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libcompiler_rt-all.ucl b/release/packages/ucl/libcompiler_rt-all.ucl
index f21e629ac88c..02be19aa0b7d 100644
--- a/release/packages/ucl/libcompiler_rt-all.ucl
+++ b/release/packages/ucl/libcompiler_rt-all.ucl
@@ -2,3 +2,7 @@ comment = "LLVM compiler_rt library"
 desc = <<EOD
 The libcompiler_rt library from LLVM.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libcuse-all.ucl b/release/packages/ucl/libcuse-all.ucl
index 0d81ee40841c..4be6e8d32a16 100644
--- a/release/packages/ucl/libcuse-all.ucl
+++ b/release/packages/ucl/libcuse-all.ucl
@@ -33,3 +33,7 @@ desc = <<EOD
 The libcuse library contains functions to create a character device in
 userspace.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libdwarf-all.ucl b/release/packages/ucl/libdwarf-all.ucl
index 456ace323a67..84905e103dc3 100644
--- a/release/packages/ucl/libdwarf-all.ucl
+++ b/release/packages/ucl/libdwarf-all.ucl
@@ -32,3 +32,7 @@ The DWARF Access Library provides functions that allow an application to read
 and write debugging information in object files.  The format of debugging
 information accessible through this API is defined by the DWARF standard.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libevent1-all.ucl b/release/packages/ucl/libevent1-all.ucl
index 9bfd88362072..4c4f2957d829 100644
--- a/release/packages/ucl/libevent1-all.ucl
+++ b/release/packages/ucl/libevent1-all.ucl
@@ -21,3 +21,7 @@ comment = "Private libevent1 library"
 desc = <<EOD
 A private library used by applications in the base system.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libexecinfo-all.ucl b/release/packages/ucl/libexecinfo-all.ucl
index bbb91e5c015c..ce826cb647d9 100644
--- a/release/packages/ucl/libexecinfo-all.ucl
+++ b/release/packages/ucl/libexecinfo-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libexecinfo provides the backtrace(3) interface to allow an application to
 examine its current call stack.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libipt-all.ucl b/release/packages/ucl/libipt-all.ucl
index eb0ef6a32d40..4bea833f0557 100644
--- a/release/packages/ucl/libipt-all.ucl
+++ b/release/packages/ucl/libipt-all.ucl
@@ -4,3 +4,7 @@ The Intel Processor Trace (Intel PT) Decoder Library is Intel's reference
 implementation for decoding Intel PT.  It can be used as a standalone library
 or it can be partially or fully integrated into your tool.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libldns-all.ucl b/release/packages/ucl/libldns-all.ucl
index 43402d1c4880..e4b39caff868 100644
--- a/release/packages/ucl/libldns-all.ucl
+++ b/release/packages/ucl/libldns-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 This package provides a private version of the NLnet Labs LDNS library for
 use by applications in the base system.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/liblzma-all.ucl b/release/packages/ucl/liblzma-all.ucl
index 6867324f3562..61424c86febb 100644
--- a/release/packages/ucl/liblzma-all.ucl
+++ b/release/packages/ucl/liblzma-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 liblzma allows applications to compress and decompress data using the XZ
 compression algorithm.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libmagic-all.ucl b/release/packages/ucl/libmagic-all.ucl
index dca9a430a32c..c3741ba935df 100644
--- a/release/packages/ucl/libmagic-all.ucl
+++ b/release/packages/ucl/libmagic-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libmagic allows an application to identity a file based on its contents
 using the magic(5) magic number database.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libmilter-all.ucl b/release/packages/ucl/libmilter-all.ucl
index 5c0e4925a9c2..fea39408e58c 100644
--- a/release/packages/ucl/libmilter-all.ucl
+++ b/release/packages/ucl/libmilter-all.ucl
@@ -5,3 +5,7 @@ programs access to mail messages as they are being processed in order
 to filter meta-information and content.  libmilter provides support for
 applications implementing the milter interface.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libpathconv-all.ucl b/release/packages/ucl/libpathconv-all.ucl
index d19efbd7d93b..a88bf3d017c2 100644
--- a/release/packages/ucl/libpathconv-all.ucl
+++ b/release/packages/ucl/libpathconv-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libpathconv provides the abs2rel() and rel2abs() functions to convert between
 absolute and relative pathnames.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/librpcsec_gss-all.ucl b/release/packages/ucl/librpcsec_gss-all.ucl
index b95be8a498c8..37ee057b6fd7 100644
--- a/release/packages/ucl/librpcsec_gss-all.ucl
+++ b/release/packages/ucl/librpcsec_gss-all.ucl
@@ -41,3 +41,7 @@ no third party can access the data for a connection.
 The librpcsec_gss provides an API to allow applications to interact with the
 RPCSEC_GSS security mechanism.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/librss-all.ucl b/release/packages/ucl/librss-all.ucl
index 8d5ea747592e..fac6d9ff5c42 100644
--- a/release/packages/ucl/librss-all.ucl
+++ b/release/packages/ucl/librss-all.ucl
@@ -4,3 +4,7 @@ desc = <<EOD
 The librss library and the functions it provides are used for both fetching the
 system RSS configuration and interacting with RSS aware sockets.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libsdp-all.ucl b/release/packages/ucl/libsdp-all.ucl
index c80542f59e95..ec9d3319b063 100644
--- a/release/packages/ucl/libsdp-all.ucl
+++ b/release/packages/ucl/libsdp-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libsdp allows applications to interact with the Bluetooth Service Discovery
 Protocol.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libsqlite3-all.ucl b/release/packages/ucl/libsqlite3-all.ucl
index de0d58b5f7c7..39364d6804f3 100644
--- a/release/packages/ucl/libsqlite3-all.ucl
+++ b/release/packages/ucl/libsqlite3-all.ucl
@@ -21,3 +21,7 @@ comment = "Private SQLite library"
 desc = <<EOD
 A private version of SQLite for use by applications in the base system.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libstdbuf-all.ucl b/release/packages/ucl/libstdbuf-all.ucl
index b82b49cfaef9..c9b1e807fe2b 100644
--- a/release/packages/ucl/libstdbuf-all.ucl
+++ b/release/packages/ucl/libstdbuf-all.ucl
@@ -33,3 +33,7 @@ The libstdbuf library can be preloaded with the LD_PRELOAD environment variable
 to change the initial buffering of standard input, standard output and standard
 error streams.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libstdthreads-all.ucl b/release/packages/ucl/libstdthreads-all.ucl
index 09e915d55902..0ac43e7576a2 100644
--- a/release/packages/ucl/libstdthreads-all.ucl
+++ b/release/packages/ucl/libstdthreads-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libstdthreads provides the thread-control interface defined in the
 ISO/IEC 9899:2011 (C11) standard.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libthread_db-all.ucl b/release/packages/ucl/libthread_db-all.ucl
index 3497e4dd76b5..fdae1e70ba41 100644
--- a/release/packages/ucl/libthread_db-all.ucl
+++ b/release/packages/ucl/libthread_db-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 libthread_db is used by the debugger to examine and interact with a
 multithreaded process being debugged.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libucl-all.ucl b/release/packages/ucl/libucl-all.ucl
index 9785ce7e7dca..aacfe67343f2 100644
--- a/release/packages/ucl/libucl-all.ucl
+++ b/release/packages/ucl/libucl-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 A private library for reading and writing UCL files, for used by applications
 in the base system.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libvgl-all.ucl b/release/packages/ucl/libvgl-all.ucl
index e497ded006a3..c45ef13a9433 100644
--- a/release/packages/ucl/libvgl-all.ucl
+++ b/release/packages/ucl/libvgl-all.ucl
@@ -45,3 +45,7 @@ memory before switching to another virtual console, and restoring when the
 user switches back.  This allows several graphic applications at once, but
 on different virtual consoles.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libvmmapi-all.ucl b/release/packages/ucl/libvmmapi-all.ucl
index 800e5365cfa7..2e748501246e 100644
--- a/release/packages/ucl/libvmmapi-all.ucl
+++ b/release/packages/ucl/libvmmapi-all.ucl
@@ -21,3 +21,7 @@ comment = "Front-end library for the vmm(4) virtualization driver"
 desc = <<EOD
 libvmmapi provides an interface for applications to access the vmm(4) driver.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/liby-all.ucl b/release/packages/ucl/liby-all.ucl
index ea320ef8b1dc..a2698faec0b0 100644
--- a/release/packages/ucl/liby-all.ucl
+++ b/release/packages/ucl/liby-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 liby provides default implementations of main() and yyerror() for applications
 which use the yacc(1) parser generator.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/libyaml-all.ucl b/release/packages/ucl/libyaml-all.ucl
index 793b9437633e..1446e226cc09 100644
--- a/release/packages/ucl/libyaml-all.ucl
+++ b/release/packages/ucl/libyaml-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 The libprivateyaml library is used by the FreeBSD base system to parse YAML
 files.  This library is not intended for use outside of the base system.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/lp-all.ucl b/release/packages/ucl/lp-all.ucl
index c8de754fb7c1..00afb70ba61f 100644
--- a/release/packages/ucl/lp-all.ucl
+++ b/release/packages/ucl/lp-all.ucl
@@ -27,3 +27,7 @@ and dispatches them to an appropriate printer.
 Some sample lp filters for common printers are also provided in
 /usr/share/examples/printing.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/natd-all.ucl b/release/packages/ucl/natd-all.ucl
index e15496a4075f..4fd0a3d30c40 100644
--- a/release/packages/ucl/natd-all.ucl
+++ b/release/packages/ucl/natd-all.ucl
@@ -26,3 +26,7 @@ with existing installations, or for users who require functionality not
 available in ipfw, such as Application Level Gateway (ALG) for the FTP
 or IRC protocols.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/netmap-all.ucl b/release/packages/ucl/netmap-all.ucl
index 998ed82324ad..69a7df614d09 100644
--- a/release/packages/ucl/netmap-all.ucl
+++ b/release/packages/ucl/netmap-all.ucl
@@ -27,3 +27,7 @@ bpf(4), tap(4), or raw sockets.
 This package provides libnetmap, a library used by applications to interact
 with netmap, and valectl(8), a utility to manage vale(4) network switches.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/nfs-all.ucl b/release/packages/ucl/nfs-all.ucl
index 7aa3b1f573d1..d48a4ef2efe2 100644
--- a/release/packages/ucl/nfs-all.ucl
+++ b/release/packages/ucl/nfs-all.ucl
@@ -32,3 +32,7 @@ NFS server, and the mount_nfs(8) utility used to mount an NFS filesystem on
 the client.  Several other daemons and utilities are also provided which may
 be necessary depending on the NFS configuration.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/ntp-all.ucl b/release/packages/ucl/ntp-all.ucl
index 9585c371d0e0..60a5d57ecc26 100644
--- a/release/packages/ucl/ntp-all.ucl
+++ b/release/packages/ucl/ntp-all.ucl
@@ -37,3 +37,7 @@ utility which can be used for testing or one-off time synchronisation.
 
 A periodic(8) script to monitor the status of the NTP daemon is also provided.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/openssl-all.ucl b/release/packages/ucl/openssl-all.ucl
index 1bc8a12fc412..398b5165330e 100644
--- a/release/packages/ucl/openssl-all.ucl
+++ b/release/packages/ucl/openssl-all.ucl
@@ -35,3 +35,7 @@ the TLS protocol itself.
 OpenSSL also provides support for the obsolete Secure Sockets Layer (SSL)
 protocol, which was commonly used prior to the standardisation of TLS.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/pf-all.ucl b/release/packages/ucl/pf-all.ucl
index 07bebf80489f..f8898dd490f1 100644
--- a/release/packages/ucl/pf-all.ucl
+++ b/release/packages/ucl/pf-all.ucl
@@ -32,3 +32,7 @@ system startup, and a periodic(8) script to report connections denied by pf.
 
 Several example pf rulesets are also provided in /usr/share/examples/pf.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/pmc-all.ucl b/release/packages/ucl/pmc-all.ucl
index 5c8e44d264b2..b4474b8a0e49 100644
--- a/release/packages/ucl/pmc-all.ucl
+++ b/release/packages/ucl/pmc-all.ucl
@@ -10,3 +10,7 @@ offered by the hwpmc(4) driver.
 The utilities pmc(8), pmcannotate(8), pmccontrol(8) and pmcstat(8) provide
 command-line access to the facilities provided by libpmc.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/quotacheck-all.ucl b/release/packages/ucl/quotacheck-all.ucl
index 77943ac7365b..d9577624668c 100644
--- a/release/packages/ucl/quotacheck-all.ucl
+++ b/release/packages/ucl/quotacheck-all.ucl
@@ -41,3 +41,7 @@ file for the file system.  If any inconsistencies are detected, both the quota
 file and the current system copy of the incorrect quotas are updated (the
 latter only occurs if an active file system is checked).
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/rcmds-all.ucl b/release/packages/ucl/rcmds-all.ucl
index a72228d28cd0..9514c8d752e6 100644
--- a/release/packages/ucl/rcmds-all.ucl
+++ b/release/packages/ucl/rcmds-all.ucl
@@ -24,3 +24,7 @@ with remote hosts over the network.  This includes the command-line utilities
 rwho, ruptime, rup, rusers and rwall and the daemons rwhod, rpc.rstatd,
 rpc.rusersd, and rpc.rwalld.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/rdma-all.ucl b/release/packages/ucl/rdma-all.ucl
index cdc0ac2faa84..be6854780b48 100644
--- a/release/packages/ucl/rdma-all.ucl
+++ b/release/packages/ucl/rdma-all.ucl
@@ -23,3 +23,7 @@ This package provides utilities for working with RDMA and InfiniBand
 networks, including the rping(1) and mckey(1) utilities used to test
 network functionality.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/rip-all.ucl b/release/packages/ucl/rip-all.ucl
index a3b681b6cf9e..ca9d2ec80d8e 100644
--- a/release/packages/ucl/rip-all.ucl
+++ b/release/packages/ucl/rip-all.ucl
@@ -25,3 +25,7 @@ routers.
 
 RIP and RIPng support is deprecated and will be removed in FreeBSD 16.0.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/sendmail-all.ucl b/release/packages/ucl/sendmail-all.ucl
index 7a80c69b6333..2879431446bf 100644
--- a/release/packages/ucl/sendmail-all.ucl
+++ b/release/packages/ucl/sendmail-all.ucl
@@ -32,3 +32,7 @@ When the full functionality of sendmail is not required, consider using the
 $PKG_NAME_PREFIX-dma package instead, a lightweight MTA which can send (but
 not receive) mail over SMTP.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/ssh-all.ucl b/release/packages/ucl/ssh-all.ucl
index 04ec3c6b6d68..274f9db3ffc5 100644
--- a/release/packages/ucl/ssh-all.ucl
+++ b/release/packages/ucl/ssh-all.ucl
@@ -35,3 +35,7 @@ and related utilities for managing SSH keys, and the sshd(8) server daemon.
 EOD
 
 licenses = [ ISCL ]
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/tcpd-all.ucl b/release/packages/ucl/tcpd-all.ucl
index be0e6fabfa26..fd659507a44e 100644
--- a/release/packages/ucl/tcpd-all.ucl
+++ b/release/packages/ucl/tcpd-all.ucl
@@ -31,3 +31,7 @@ Wrappers using the tcpd(8) utility.
 This package also provides a periodic(8) script used to report TCP Wrappers
 activity.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/telnet-all.ucl b/release/packages/ucl/telnet-all.ucl
index 0f496e1b1246..426985642560 100644
--- a/release/packages/ucl/telnet-all.ucl
+++ b/release/packages/ucl/telnet-all.ucl
@@ -27,3 +27,7 @@ particular, the Kerberos 5 support is limited to DES encryption) and
 should not be used to transfer sensitive data such as passwords.
 In most situations, the Secure Shell protocol is preferred over TELNET.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/unbound-all.ucl b/release/packages/ucl/unbound-all.ucl
index bfbc41f444a0..40a292bc9685 100644
--- a/release/packages/ucl/unbound-all.ucl
+++ b/release/packages/ucl/unbound-all.ucl
@@ -29,3 +29,7 @@ as "dns/unbound".
 EOD
 
 licenses = [ BSD4CLAUSE ]
+
+annotations {
+	set = "base,base-jail"
+}
diff --git a/release/packages/ucl/yp-all.ucl b/release/packages/ucl/yp-all.ucl
index 4170e6922e56..0cdea7e130c4 100644
--- a/release/packages/ucl/yp-all.ucl
+++ b/release/packages/ucl/yp-all.ucl
@@ -24,3 +24,7 @@ information across machines on a network.  This packages contain the YP
 server, YP management utilities, the YP-LDAP gateway (ypldap), YP client
 utilities and a sample Makefile for building the YP database.
 EOD
+
+annotations {
+	set = "base,base-jail"
+}