packages: Add an "optional" set

This is everything in "base" but without compilers.  This means we
have sets to support four basic workloads:

- "minimal" for a small installation where the user intends to add
  other packages by hand.

- "optional" for a complete installation on a production system which
  does not need to compile software.

- "devel", which can be added to either minimal or optional when
  compilers are required.

- "base" for a complete installation, including compilers, for users
  who don't want to interact with pkgbase and just want the complete
  system installed like it was before.

This is probably the last set want to add; any further metapackages
would be better treated as "task" packages intended to target one
specific workload.

MFC after:	3 days
Reviewed by:	cperciva, bapt
Differential Revision:	https://reviews.freebsd.org/D52777

97 files changed, 289 insertions, 75 deletions

diff --git a/release/packages/sets/base-jail.ucl b/release/packages/sets/base-jail.ucl
index e6c52349d3cb..d1dc17bc9860 100644
--- a/release/packages/sets/base-jail.ucl
+++ b/release/packages/sets/base-jail.ucl
@@ -16,7 +16,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-comment = "Base jail system (metapackage)"
+comment = "Base system for jails (metapackage)"
 
 vital = true
 
@@ -30,6 +30,10 @@ deps {
 		version = "${VERSION}"
 		origin = "base"
 	},
+	"set-optional-jail" {
+		version = "${VERSION}"
+		origin = "base"
+	},
 	"set-devel" {
 		version = "${VERSION}"
 		origin = "base"
diff --git a/release/packages/sets/base.ucl b/release/packages/sets/base.ucl
index 7b86450ae5b2..823e2342fab8 100644
--- a/release/packages/sets/base.ucl
+++ b/release/packages/sets/base.ucl
@@ -21,7 +21,11 @@ comment = "Base system (metapackage)"
 vital = true
 
 desc = <<EOD
-This metapackage installs all packages which are part of the base system.
+This metapackage installs all packages which are part of the base system,
+excluding 32-bit compatibility libraries, tests, debugging symbols, and
+source code.
+
+This is equivalent to installing the legacy "base.txz" distribution set.
 EOD
 
 deps {
@@ -29,6 +33,10 @@ deps {
 		version = "${VERSION}"
 		origin = "base"
 	},
+	"set-optional" {
+		version = "${VERSION}"
+		origin = "base"
+	},
 	"set-devel" {
 		version = "${VERSION}"
 		origin = "base"
diff --git a/release/packages/sets/optional-dbg.ucl b/release/packages/sets/optional-dbg.ucl
new file mode 100644
index 000000000000..a221327518f9
--- /dev/null
+++ b/release/packages/sets/optional-dbg.ucl
@@ -0,0 +1,31 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Optional software debug symbols (metapackage)"
+
+desc = <<EOD
+This metapackage installs debugging symbols for optional software
+which is not part of the minimal set.
+EOD
+
+deps {
+	"set-minimal-dbg" {
+		version = "${VERSION}"
+		origin = "base"
+	},
+}
diff --git a/release/packages/sets/optional-jail-dbg.ucl b/release/packages/sets/optional-jail-dbg.ucl
new file mode 100644
index 000000000000..84c76fa407fe
--- /dev/null
+++ b/release/packages/sets/optional-jail-dbg.ucl
@@ -0,0 +1,31 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Optional software debug symbols for jails (metapackage)"
+
+desc = <<EOD
+This metapackage installs debugging symbols for optional software
+which is not part of the minimal set.
+EOD
+
+deps {
+	"set-minimal-jail-dbg" {
+		version = "${VERSION}"
+		origin = "base"
+	},
+}
diff --git a/release/packages/sets/optional-jail.ucl b/release/packages/sets/optional-jail.ucl
new file mode 100644
index 000000000000..da6d5fb00825
--- /dev/null
+++ b/release/packages/sets/optional-jail.ucl
@@ -0,0 +1,34 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Optional base system software for jails (metapackage)"
+
+vital = true
+
+desc = <<EOD
+This metapackage installs all optional software which is part of the
+base system but not installed by the minimal set, other than compilers
+and software which is not generally useful in a jail(8) environment.
+EOD
+
+deps {
+	"set-minimal-jail" {
+		version = "${VERSION}"
+		origin = "base"
+	},
+}
diff --git a/release/packages/sets/optional.ucl b/release/packages/sets/optional.ucl
new file mode 100644
index 000000000000..f50fa17e4297
--- /dev/null
+++ b/release/packages/sets/optional.ucl
@@ -0,0 +1,33 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Optional base system software (metapackage)"
+
+vital = true
+
+desc = <<EOD
+This metapackage installs all optional software, other than compilers,
+which is part of the base system but not installed by the minimal set.
+EOD
+
+deps {
+	"set-minimal" {
+		version = "${VERSION}"
+		origin = "base"
+	},
+}
diff --git a/release/packages/ucl/acct-all.ucl b/release/packages/ucl/acct-all.ucl
index f4c7119af798..e6c98c3180ce 100644
--- a/release/packages/ucl/acct-all.ucl
+++ b/release/packages/ucl/acct-all.ucl
@@ -31,5 +31,5 @@ system provided in the $PKG_NAME_PREFIX-audit package for that.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/acpi-all.ucl b/release/packages/ucl/acpi-all.ucl
index c459f0004f5d..9e75822a8a04 100644
--- a/release/packages/ucl/acpi-all.ucl
+++ b/release/packages/ucl/acpi-all.ucl
@@ -34,3 +34,7 @@ ACPI implementation in the kernel:
 * acpidump(8) dumps the system's raw ACPI data.
 * iasl(8) is the Intel ACPI compiler/decompiler
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/apm-all.ucl b/release/packages/ucl/apm-all.ucl
index 1318befc4273..a0ade7fb8a5f 100644
--- a/release/packages/ucl/apm-all.ucl
+++ b/release/packages/ucl/apm-all.ucl
@@ -27,3 +27,7 @@ This package provides apm(8), a utility which can be used to monitor the APM
 state and change the system power mode, and the /etc/rc.d/apm service which
 can enable and disable APM at system startup and shutdown.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/atf-all.ucl b/release/packages/ucl/atf-all.ucl
index 3014163c95bd..6e86955fb539 100644
--- a/release/packages/ucl/atf-all.ucl
+++ b/release/packages/ucl/atf-all.ucl
@@ -35,5 +35,5 @@ interface.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/audit-all.ucl b/release/packages/ucl/audit-all.ucl
index 43074b3bf299..3324795d8d9c 100644
--- a/release/packages/ucl/audit-all.ucl
+++ b/release/packages/ucl/audit-all.ucl
@@ -44,5 +44,5 @@ used to manage the auditing system and work with audit data.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/autofs-all.ucl b/release/packages/ucl/autofs-all.ucl
index 63261b9ce8d1..d45949847ce1 100644
--- a/release/packages/ucl/autofs-all.ucl
+++ b/release/packages/ucl/autofs-all.ucl
@@ -29,5 +29,5 @@ managing this, as well as the management utility automount(8).
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/bhyve-all.ucl b/release/packages/ucl/bhyve-all.ucl
index c4e450a47934..c01a826a123f 100644
--- a/release/packages/ucl/bhyve-all.ucl
+++ b/release/packages/ucl/bhyve-all.ucl
@@ -42,5 +42,5 @@ which can be used to run simple virtual machines.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/blocklist-all.ucl b/release/packages/ucl/blocklist-all.ucl
index 6e94b3822cf0..92f304ac9151 100644
--- a/release/packages/ucl/blocklist-all.ucl
+++ b/release/packages/ucl/blocklist-all.ucl
@@ -28,5 +28,5 @@ only daemons which have had blacklist support added will work.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/bluetooth-all.ucl b/release/packages/ucl/bluetooth-all.ucl
index a2376996ec60..55ce4f37f475 100644
--- a/release/packages/ucl/bluetooth-all.ucl
+++ b/release/packages/ucl/bluetooth-all.ucl
@@ -24,3 +24,7 @@ network devices, including the /etc/rc.d/bluetooth service which manages
 the Bluetooth stack when Bluetooth devices are attached or removed, and
 the rfcomm_pppd(8) daemon which manages PPP connections over Bluetooth.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/bsdconfig-all.ucl b/release/packages/ucl/bsdconfig-all.ucl
index 944dc0a259da..42e4114ba20d 100644
--- a/release/packages/ucl/bsdconfig-all.ucl
+++ b/release/packages/ucl/bsdconfig-all.ucl
@@ -27,5 +27,5 @@ the rc.conf(5) configuration.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/bsdinstall-all.ucl b/release/packages/ucl/bsdinstall-all.ucl
index 2e01cbcb51ca..a3fa820e1383 100644
--- a/release/packages/ucl/bsdinstall-all.ucl
+++ b/release/packages/ucl/bsdinstall-all.ucl
@@ -37,5 +37,5 @@ images and jails.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/bsnmp-all.ucl b/release/packages/ucl/bsnmp-all.ucl
index 88a777b3181d..9d02968b0ebf 100644
--- a/release/packages/ucl/bsnmp-all.ucl
+++ b/release/packages/ucl/bsnmp-all.ucl
@@ -42,5 +42,5 @@ bsnmpd can be used in unexpected ways.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/ccdconfig-all.ucl b/release/packages/ucl/ccdconfig-all.ucl
index 8f7d1e4300a5..7c23c56d9a29 100644
--- a/release/packages/ucl/ccdconfig-all.ucl
+++ b/release/packages/ucl/ccdconfig-all.ucl
@@ -22,3 +22,7 @@ desc = <<EOD
 ccdconfig(8) is used to configure the concatenated disk driver, ccd(4).
 ccdconfig(8) may also be started on boot using the "ccd" rc(8) service.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/console-tools-all.ucl b/release/packages/ucl/console-tools-all.ucl
index fee09a1ea3f5..1eef02d8370d 100644
--- a/release/packages/ucl/console-tools-all.ucl
+++ b/release/packages/ucl/console-tools-all.ucl
@@ -29,3 +29,7 @@ to the system:
 * moused(8) can be used to interface with a mouse and provide a graphical
   mouse cursor on the video console.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/csh-all.ucl b/release/packages/ucl/csh-all.ucl
index 787c43bdb82b..1df758ed29ec 100644
--- a/release/packages/ucl/csh-all.ucl
+++ b/release/packages/ucl/csh-all.ucl
@@ -40,5 +40,5 @@ a history mechanism, job control, and a C-like syntax.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/ctl-all.ucl b/release/packages/ucl/ctl-all.ucl
index 22eebb7a2eee..9aa4de455df7 100644
--- a/release/packages/ucl/ctl-all.ucl
+++ b/release/packages/ucl/ctl-all.ucl
@@ -39,3 +39,7 @@ the CAM Target Layer configuration, accepting incoming iSCSI connections,
 performing authentication and passing connections to the kernel part of the
 native iSCSI target.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/cxgbe-tools-all.ucl b/release/packages/ucl/cxgbe-tools-all.ucl
index 33701ae96951..34e1718bb83e 100644
--- a/release/packages/ucl/cxgbe-tools-all.ucl
+++ b/release/packages/ucl/cxgbe-tools-all.ucl
@@ -25,3 +25,7 @@ state of the interface, loading firmware, and configuring features such
 as the hardware packet filter, Quality-of-Service (QoS) scheduler, and
 TCP offload engine.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/dma-all.ucl b/release/packages/ucl/dma-all.ucl
index 7b52c48a6def..1465fa44f5f1 100644
--- a/release/packages/ucl/dma-all.ucl
+++ b/release/packages/ucl/dma-all.ucl
@@ -48,5 +48,5 @@ the $PKG_NAME_PREFIX-sendmail package instead.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/dtrace-all.ucl b/release/packages/ucl/dtrace-all.ucl
index 7969ed59c144..c41ca59621de 100644
--- a/release/packages/ucl/dtrace-all.ucl
+++ b/release/packages/ucl/dtrace-all.ucl
@@ -27,3 +27,7 @@ This package provides the dtrace(1) utility for executing DTrace scripts written
 in the D language, the utilities lockstat(1) and plockstat(1), and several
 example D scripts installed in /usr/share/dtrace.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/dwatch-all.ucl b/release/packages/ucl/dwatch-all.ucl
index d4646c78101e..c4a6527677f7 100644
--- a/release/packages/ucl/dwatch-all.ucl
+++ b/release/packages/ucl/dwatch-all.ucl
@@ -35,3 +35,7 @@ DTrace scripts to coalesce trace output by date/time, process info, and
 [optionally] probe-specific data.  dwatch also includes a set of pre-defined
 profiles for tracing common system operations.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/ee-all.ucl b/release/packages/ucl/ee-all.ucl
index fbad921e7ef8..93f9d5e056af 100644
--- a/release/packages/ucl/ee-all.ucl
+++ b/release/packages/ucl/ee-all.ucl
@@ -25,5 +25,5 @@ new users.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/examples-all.ucl b/release/packages/ucl/examples-all.ucl
index 027c65427924..15b0b8aadd0f 100644
--- a/release/packages/ucl/examples-all.ucl
+++ b/release/packages/ucl/examples-all.ucl
@@ -26,5 +26,5 @@ Some useful graphics data related to the "Beastie" mascot are also provided.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/fd-all.ucl b/release/packages/ucl/fd-all.ucl
index 768dac3c1a0c..ff87148049ef 100644
--- a/release/packages/ucl/fd-all.ucl
+++ b/release/packages/ucl/fd-all.ucl
@@ -26,3 +26,7 @@ by the fdc(4) driver:
 * fdformat(8) is used to format disks.
 * fdread(1) and fdwrite(1) read and write data to or from floppy disks.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/ftp-all.ucl b/release/packages/ucl/ftp-all.ucl
index 285bf72529b5..626feabc69af 100644
--- a/release/packages/ucl/ftp-all.ucl
+++ b/release/packages/ucl/ftp-all.ucl
@@ -24,5 +24,5 @@ protocol (RFC 959) to upload and download files.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/games-all.ucl b/release/packages/ucl/games-all.ucl
index 80339ef6cdea..0716b0c79c19 100644
--- a/release/packages/ucl/games-all.ucl
+++ b/release/packages/ucl/games-all.ucl
@@ -28,5 +28,5 @@ Games distributed with the system:
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/ggate-all.ucl b/release/packages/ucl/ggate-all.ucl
index 9b968e1b1239..9a8ba37f0f66 100644
--- a/release/packages/ucl/ggate-all.ucl
+++ b/release/packages/ucl/ggate-all.ucl
@@ -30,3 +30,7 @@ such as iSCSI.
 This package provides the ggated(8) server used to export devices, and
 the ggatec(8) client used to access them.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/gssd-all.ucl b/release/packages/ucl/gssd-all.ucl
index dfd2958d143e..c3e76e365ac4 100644
--- a/release/packages/ucl/gssd-all.ucl
+++ b/release/packages/ucl/gssd-all.ucl
@@ -30,5 +30,5 @@ This daemon is required when using Kerberos authentication with NFS.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/hast-all.ucl b/release/packages/ucl/hast-all.ucl
index f4eed4eb81bd..9fb4ed1a350d 100644
--- a/release/packages/ucl/hast-all.ucl
+++ b/release/packages/ucl/hast-all.ucl
@@ -23,3 +23,7 @@ The Highly Available Storage daemon, hastd(8), provides replication of block
 storage devices between two machines on a network.  HAST can be used by itself
 or as part of an HA cluster to provide redundant cluster storage.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/hostapd-all.ucl b/release/packages/ucl/hostapd-all.ucl
index a2639c464935..cb25beab4f58 100644
--- a/release/packages/ucl/hostapd-all.ucl
+++ b/release/packages/ucl/hostapd-all.ucl
@@ -24,3 +24,7 @@ IEEE Std 802.11 wireless network interface configured in Access Point (AP)
 mode.  hostapd can authenticate clients itself via 802.11i (WPA), or via
 802.1X (EAP) using an external RADIUS server.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/inetd-all.ucl b/release/packages/ucl/inetd-all.ucl
index be1e44fbaa3d..bff3393e5f73 100644
--- a/release/packages/ucl/inetd-all.ucl
+++ b/release/packages/ucl/inetd-all.ucl
@@ -25,5 +25,5 @@ built-in servers for basic services are also provided.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/ipf-all.ucl b/release/packages/ucl/ipf-all.ucl
index 04a0a8ef7469..d9ca0424a442 100644
--- a/release/packages/ucl/ipf-all.ucl
+++ b/release/packages/ucl/ipf-all.ucl
@@ -27,5 +27,5 @@ of configuring IP Filter are also provided in /usr/share/examples/ipfilter.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/ipfw-all.ucl b/release/packages/ucl/ipfw-all.ucl
index 4eec24194633..1a76aca68987 100644
--- a/release/packages/ucl/ipfw-all.ucl
+++ b/release/packages/ucl/ipfw-all.ucl
@@ -30,5 +30,5 @@ at system startup.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/iscsi-all.ucl b/release/packages/ucl/iscsi-all.ucl
index 928dfe2d0176..c59345a0e147 100644
--- a/release/packages/ucl/iscsi-all.ucl
+++ b/release/packages/ucl/iscsi-all.ucl
@@ -24,3 +24,7 @@ network.  This package provides iscsid(8), the userland component of the iSCSI
 initiator, the iscsictl(8) utility used to monitor and configure the initiator,
 and rc(8) services to configure the initiator during system startup.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/jail-all.ucl b/release/packages/ucl/jail-all.ucl
index 6cd085581240..d2f069f2eb52 100644
--- a/release/packages/ucl/jail-all.ucl
+++ b/release/packages/ucl/jail-all.ucl
@@ -32,5 +32,5 @@ the /etc/jail.conf configuration file.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/kerberos-all.ucl b/release/packages/ucl/kerberos-all.ucl
index a62be895e96d..c888ff5be6e0 100644
--- a/release/packages/ucl/kerberos-all.ucl
+++ b/release/packages/ucl/kerberos-all.ucl
@@ -34,5 +34,5 @@ sometimes called Kerberos V.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/kerberos-kdc-all.ucl b/release/packages/ucl/kerberos-kdc-all.ucl
index 7c2d412460ec..21b0d2121be7 100644
--- a/release/packages/ucl/kerberos-kdc-all.ucl
+++ b/release/packages/ucl/kerberos-kdc-all.ucl
@@ -29,5 +29,5 @@ manages the Kerberos database and issues tickets to Kerberos users.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/kyua-all.ucl b/release/packages/ucl/kyua-all.ucl
index e7a26de7ea6d..2b38efc30d96 100644
--- a/release/packages/ucl/kyua-all.ucl
+++ b/release/packages/ucl/kyua-all.ucl
@@ -54,5 +54,5 @@ TAP-compliant test programs can also be executed through kyua.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "devel"
 }
diff --git a/release/packages/ucl/lib9p-all.ucl b/release/packages/ucl/lib9p-all.ucl
index 9eb030bd7a0c..2cc31d4a3889 100644
--- a/release/packages/ucl/lib9p-all.ucl
+++ b/release/packages/ucl/lib9p-all.ucl
@@ -24,5 +24,5 @@ of the 9P protocol.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libarchive-all.ucl b/release/packages/ucl/libarchive-all.ucl
index 79a80b6a4c54..742734bf8b62 100644
--- a/release/packages/ucl/libarchive-all.ucl
+++ b/release/packages/ucl/libarchive-all.ucl
@@ -34,5 +34,5 @@ such as gzip and bzip2.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libbegemot-all.ucl b/release/packages/ucl/libbegemot-all.ucl
index c1080de8f253..812e94f72eaf 100644
--- a/release/packages/ucl/libbegemot-all.ucl
+++ b/release/packages/ucl/libbegemot-all.ucl
@@ -46,5 +46,5 @@ and, in addition to select(2) and poll(2) also support timers.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libblocksruntime-all.ucl b/release/packages/ucl/libblocksruntime-all.ucl
index 4b4085d9d0da..72f1fca68a99 100644
--- a/release/packages/ucl/libblocksruntime-all.ucl
+++ b/release/packages/ucl/libblocksruntime-all.ucl
@@ -25,5 +25,5 @@ support for lambda expressions and closures.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libbsdstat-all.ucl b/release/packages/ucl/libbsdstat-all.ucl
index acfb77fd6242..144d4200fed9 100644
--- a/release/packages/ucl/libbsdstat-all.ucl
+++ b/release/packages/ucl/libbsdstat-all.ucl
@@ -24,5 +24,5 @@ statistics.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libbsm-all.ucl b/release/packages/ucl/libbsm-all.ucl
index 76852b310e8f..02022b91f83a 100644
--- a/release/packages/ucl/libbsm-all.ucl
+++ b/release/packages/ucl/libbsm-all.ucl
@@ -36,5 +36,5 @@ of new audit records and streams.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libcasper-all.ucl b/release/packages/ucl/libcasper-all.ucl
index 4f839ef6fc46..387200b6d1bf 100644
--- a/release/packages/ucl/libcasper-all.ucl
+++ b/release/packages/ucl/libcasper-all.ucl
@@ -26,5 +26,5 @@ helper process to allow restricted access to system and network resources.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libcompat-all.ucl b/release/packages/ucl/libcompat-all.ucl
index 1fb209f4cafc..f78c54d93216 100644
--- a/release/packages/ucl/libcompat-all.ucl
+++ b/release/packages/ucl/libcompat-all.ucl
@@ -24,5 +24,5 @@ cuserid(3), re_comp(3), re_exec(3) and rexec(3).
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libcompiler_rt-all.ucl b/release/packages/ucl/libcompiler_rt-all.ucl
index 02be19aa0b7d..af7890c61639 100644
--- a/release/packages/ucl/libcompiler_rt-all.ucl
+++ b/release/packages/ucl/libcompiler_rt-all.ucl
@@ -4,5 +4,5 @@ The libcompiler_rt library from LLVM.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libcuse-all.ucl b/release/packages/ucl/libcuse-all.ucl
index 4be6e8d32a16..422fcb6d3d90 100644
--- a/release/packages/ucl/libcuse-all.ucl
+++ b/release/packages/ucl/libcuse-all.ucl
@@ -35,5 +35,5 @@ userspace.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libdwarf-all.ucl b/release/packages/ucl/libdwarf-all.ucl
index 84905e103dc3..00ec7fcdc452 100644
--- a/release/packages/ucl/libdwarf-all.ucl
+++ b/release/packages/ucl/libdwarf-all.ucl
@@ -34,5 +34,5 @@ information accessible through this API is defined by the DWARF standard.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libevent1-all.ucl b/release/packages/ucl/libevent1-all.ucl
index 4c4f2957d829..31fdf055d8dc 100644
--- a/release/packages/ucl/libevent1-all.ucl
+++ b/release/packages/ucl/libevent1-all.ucl
@@ -23,5 +23,5 @@ A private library used by applications in the base system.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libexecinfo-all.ucl b/release/packages/ucl/libexecinfo-all.ucl
index ce826cb647d9..5cdbea8153d1 100644
--- a/release/packages/ucl/libexecinfo-all.ucl
+++ b/release/packages/ucl/libexecinfo-all.ucl
@@ -24,5 +24,5 @@ examine its current call stack.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libipt-all.ucl b/release/packages/ucl/libipt-all.ucl
index 4bea833f0557..21f8cf29d437 100644
--- a/release/packages/ucl/libipt-all.ucl
+++ b/release/packages/ucl/libipt-all.ucl
@@ -6,5 +6,5 @@ or it can be partially or fully integrated into your tool.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libldns-all.ucl b/release/packages/ucl/libldns-all.ucl
index e4b39caff868..98aa86f9bc53 100644
--- a/release/packages/ucl/libldns-all.ucl
+++ b/release/packages/ucl/libldns-all.ucl
@@ -24,5 +24,5 @@ use by applications in the base system.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/liblzma-all.ucl b/release/packages/ucl/liblzma-all.ucl
index 61424c86febb..d5698d48332a 100644
--- a/release/packages/ucl/liblzma-all.ucl
+++ b/release/packages/ucl/liblzma-all.ucl
@@ -24,5 +24,5 @@ compression algorithm.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libmagic-all.ucl b/release/packages/ucl/libmagic-all.ucl
index c3741ba935df..dc623a14b57e 100644
--- a/release/packages/ucl/libmagic-all.ucl
+++ b/release/packages/ucl/libmagic-all.ucl
@@ -24,5 +24,5 @@ using the magic(5) magic number database.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libmilter-all.ucl b/release/packages/ucl/libmilter-all.ucl
index fea39408e58c..336e9f8c2c78 100644
--- a/release/packages/ucl/libmilter-all.ucl
+++ b/release/packages/ucl/libmilter-all.ucl
@@ -7,5 +7,5 @@ applications implementing the milter interface.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libpathconv-all.ucl b/release/packages/ucl/libpathconv-all.ucl
index a88bf3d017c2..985774986514 100644
--- a/release/packages/ucl/libpathconv-all.ucl
+++ b/release/packages/ucl/libpathconv-all.ucl
@@ -24,5 +24,5 @@ absolute and relative pathnames.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/librpcsec_gss-all.ucl b/release/packages/ucl/librpcsec_gss-all.ucl
index 37ee057b6fd7..a520b75be179 100644
--- a/release/packages/ucl/librpcsec_gss-all.ucl
+++ b/release/packages/ucl/librpcsec_gss-all.ucl
@@ -43,5 +43,5 @@ RPCSEC_GSS security mechanism.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/librss-all.ucl b/release/packages/ucl/librss-all.ucl
index fac6d9ff5c42..68b1ae5fbb11 100644
--- a/release/packages/ucl/librss-all.ucl
+++ b/release/packages/ucl/librss-all.ucl
@@ -6,5 +6,5 @@ system RSS configuration and interacting with RSS aware sockets.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libsdp-all.ucl b/release/packages/ucl/libsdp-all.ucl
index ec9d3319b063..e4f848c3281c 100644
--- a/release/packages/ucl/libsdp-all.ucl
+++ b/release/packages/ucl/libsdp-all.ucl
@@ -24,5 +24,5 @@ Protocol.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libsqlite3-all.ucl b/release/packages/ucl/libsqlite3-all.ucl
index 39364d6804f3..8b770e1ce5ee 100644
--- a/release/packages/ucl/libsqlite3-all.ucl
+++ b/release/packages/ucl/libsqlite3-all.ucl
@@ -23,5 +23,5 @@ A private version of SQLite for use by applications in the base system.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libstdbuf-all.ucl b/release/packages/ucl/libstdbuf-all.ucl
index c9b1e807fe2b..d3e4a6a62478 100644
--- a/release/packages/ucl/libstdbuf-all.ucl
+++ b/release/packages/ucl/libstdbuf-all.ucl
@@ -35,5 +35,5 @@ error streams.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libstdthreads-all.ucl b/release/packages/ucl/libstdthreads-all.ucl
index 0ac43e7576a2..493a1cce1a46 100644
--- a/release/packages/ucl/libstdthreads-all.ucl
+++ b/release/packages/ucl/libstdthreads-all.ucl
@@ -24,5 +24,5 @@ ISO/IEC 9899:2011 (C11) standard.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libthread_db-all.ucl b/release/packages/ucl/libthread_db-all.ucl
index fdae1e70ba41..540e155ccd99 100644
--- a/release/packages/ucl/libthread_db-all.ucl
+++ b/release/packages/ucl/libthread_db-all.ucl
@@ -24,5 +24,5 @@ multithreaded process being debugged.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libucl-all.ucl b/release/packages/ucl/libucl-all.ucl
index aacfe67343f2..4763038a8668 100644
--- a/release/packages/ucl/libucl-all.ucl
+++ b/release/packages/ucl/libucl-all.ucl
@@ -24,5 +24,5 @@ in the base system.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libvgl-all.ucl b/release/packages/ucl/libvgl-all.ucl
index c45ef13a9433..88fd51fffffd 100644
--- a/release/packages/ucl/libvgl-all.ucl
+++ b/release/packages/ucl/libvgl-all.ucl
@@ -47,5 +47,5 @@ on different virtual consoles.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libvmmapi-all.ucl b/release/packages/ucl/libvmmapi-all.ucl
index 2e748501246e..1246a488d4be 100644
--- a/release/packages/ucl/libvmmapi-all.ucl
+++ b/release/packages/ucl/libvmmapi-all.ucl
@@ -23,5 +23,5 @@ libvmmapi provides an interface for applications to access the vmm(4) driver.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/liby-all.ucl b/release/packages/ucl/liby-all.ucl
index a2698faec0b0..313058e08710 100644
--- a/release/packages/ucl/liby-all.ucl
+++ b/release/packages/ucl/liby-all.ucl
@@ -24,5 +24,5 @@ which use the yacc(1) parser generator.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/libyaml-all.ucl b/release/packages/ucl/libyaml-all.ucl
index 1446e226cc09..abfded908a87 100644
--- a/release/packages/ucl/libyaml-all.ucl
+++ b/release/packages/ucl/libyaml-all.ucl
@@ -24,5 +24,5 @@ files.  This library is not intended for use outside of the base system.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/lp-all.ucl b/release/packages/ucl/lp-all.ucl
index 00afb70ba61f..6c4e55dbdfef 100644
--- a/release/packages/ucl/lp-all.ucl
+++ b/release/packages/ucl/lp-all.ucl
@@ -29,5 +29,5 @@ Some sample lp filters for common printers are also provided in
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/mlx-tools-all.ucl b/release/packages/ucl/mlx-tools-all.ucl
index ef02c60ae8b2..3b254bf51577 100644
--- a/release/packages/ucl/mlx-tools-all.ucl
+++ b/release/packages/ucl/mlx-tools-all.ucl
@@ -33,3 +33,7 @@ The mlx5tool utility is provided for management of the Connect-X4, 5 and
 6 network adapters in the aspects not covered by the generic ifconfig(8)
 command, mostly related to the PCIe attachment and internal card working.
 EOD
+
+annotations {
+	set = "optional"
+}
diff --git a/release/packages/ucl/natd-all.ucl b/release/packages/ucl/natd-all.ucl
index 4fd0a3d30c40..95f8e8cff031 100644
--- a/release/packages/ucl/natd-all.ucl
+++ b/release/packages/ucl/natd-all.ucl
@@ -28,5 +28,5 @@ or IRC protocols.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/netmap-all.ucl b/release/packages/ucl/netmap-all.ucl
index 69a7df614d09..e0770c14c0f2 100644
--- a/release/packages/ucl/netmap-all.ucl
+++ b/release/packages/ucl/netmap-all.ucl
@@ -29,5 +29,5 @@ with netmap, and valectl(8), a utility to manage vale(4) network switches.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/nfs-all.ucl b/release/packages/ucl/nfs-all.ucl
index d48a4ef2efe2..0c9141f2076c 100644
--- a/release/packages/ucl/nfs-all.ucl
+++ b/release/packages/ucl/nfs-all.ucl
@@ -34,5 +34,5 @@ be necessary depending on the NFS configuration.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/ntp-all.ucl b/release/packages/ucl/ntp-all.ucl
index 60a5d57ecc26..c0a3fb688d97 100644
--- a/release/packages/ucl/ntp-all.ucl
+++ b/release/packages/ucl/ntp-all.ucl
@@ -39,5 +39,5 @@ A periodic(8) script to monitor the status of the NTP daemon is also provided.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/nvme-tools-all.ucl b/release/packages/ucl/nvme-tools-all.ucl
index 910936f6e70c..ca4d8daff0d2 100644
--- a/release/packages/ucl/nvme-tools-all.ucl
+++ b/release/packages/ucl/nvme-tools-all.ucl
@@ -23,3 +23,7 @@ This package provides the nvmecontrol(8) utility, which is used to monitor
 and configure NVMe devices connected to the local system, and to discover
 and connect to remote NVMe over Fabrics (NVMe-oF) targets.
 EOD
+
+annotations {
+	set = optional
+}
diff --git a/release/packages/ucl/openssl-all.ucl b/release/packages/ucl/openssl-all.ucl
index 398b5165330e..24a83ab6b9ba 100644
--- a/release/packages/ucl/openssl-all.ucl
+++ b/release/packages/ucl/openssl-all.ucl
@@ -37,5 +37,5 @@ protocol, which was commonly used prior to the standardisation of TLS.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/pf-all.ucl b/release/packages/ucl/pf-all.ucl
index f8898dd490f1..b1d0ca915d72 100644
--- a/release/packages/ucl/pf-all.ucl
+++ b/release/packages/ucl/pf-all.ucl
@@ -34,5 +34,5 @@ Several example pf rulesets are also provided in /usr/share/examples/pf.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/pmc-all.ucl b/release/packages/ucl/pmc-all.ucl
index b4474b8a0e49..1562bde741a0 100644
--- a/release/packages/ucl/pmc-all.ucl
+++ b/release/packages/ucl/pmc-all.ucl
@@ -12,5 +12,5 @@ command-line access to the facilities provided by libpmc.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/quotacheck-all.ucl b/release/packages/ucl/quotacheck-all.ucl
index d9577624668c..de29ff373f0c 100644
--- a/release/packages/ucl/quotacheck-all.ucl
+++ b/release/packages/ucl/quotacheck-all.ucl
@@ -43,5 +43,5 @@ latter only occurs if an active file system is checked).
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/rcmds-all.ucl b/release/packages/ucl/rcmds-all.ucl
index 9514c8d752e6..c2295af91f9e 100644
--- a/release/packages/ucl/rcmds-all.ucl
+++ b/release/packages/ucl/rcmds-all.ucl
@@ -26,5 +26,5 @@ rpc.rusersd, and rpc.rwalld.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/rdma-all.ucl b/release/packages/ucl/rdma-all.ucl
index be6854780b48..c12104170731 100644
--- a/release/packages/ucl/rdma-all.ucl
+++ b/release/packages/ucl/rdma-all.ucl
@@ -25,5 +25,5 @@ network functionality.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/rip-all.ucl b/release/packages/ucl/rip-all.ucl
index ca9d2ec80d8e..f3cfc2c80211 100644
--- a/release/packages/ucl/rip-all.ucl
+++ b/release/packages/ucl/rip-all.ucl
@@ -27,5 +27,5 @@ RIP and RIPng support is deprecated and will be removed in FreeBSD 16.0.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/sendmail-all.ucl b/release/packages/ucl/sendmail-all.ucl
index 2879431446bf..2b26f982db7d 100644
--- a/release/packages/ucl/sendmail-all.ucl
+++ b/release/packages/ucl/sendmail-all.ucl
@@ -34,5 +34,5 @@ not receive) mail over SMTP.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/smbutils-all.ucl b/release/packages/ucl/smbutils-all.ucl
index 746441d83f73..719afd295d89 100644
--- a/release/packages/ucl/smbutils-all.ucl
+++ b/release/packages/ucl/smbutils-all.ucl
@@ -26,3 +26,7 @@ Message Block (SMB) protocol, sometimes called CIFS.
 This facility only supports SMB version 1, which is strongly deprecated
 and not supported by most SMB servers.
 EOD
+
+annotations {
+	set = optional
+}
diff --git a/release/packages/ucl/ssh-all.ucl b/release/packages/ucl/ssh-all.ucl
index 274f9db3ffc5..1bf93f85dbbf 100644
--- a/release/packages/ucl/ssh-all.ucl
+++ b/release/packages/ucl/ssh-all.ucl
@@ -37,5 +37,5 @@ EOD
 licenses = [ ISCL ]
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/syscons-data-all.ucl b/release/packages/ucl/syscons-data-all.ucl
index 5284b8f6dc10..140eebc42a73 100644
--- a/release/packages/ucl/syscons-data-all.ucl
+++ b/release/packages/ucl/syscons-data-all.ucl
@@ -21,3 +21,7 @@ comment = "syscons(4) fonts and keymaps"
 desc = <<EOD
 Fonts and keymaps for use with the legacy syscons(4) video console driver.
 EOD
+
+annotations {
+	set = optional
+}
diff --git a/release/packages/ucl/tcpd-all.ucl b/release/packages/ucl/tcpd-all.ucl
index fd659507a44e..c9cdcab9dde1 100644
--- a/release/packages/ucl/tcpd-all.ucl
+++ b/release/packages/ucl/tcpd-all.ucl
@@ -33,5 +33,5 @@ activity.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/telnet-all.ucl b/release/packages/ucl/telnet-all.ucl
index 426985642560..af4c9001be0f 100644
--- a/release/packages/ucl/telnet-all.ucl
+++ b/release/packages/ucl/telnet-all.ucl
@@ -29,5 +29,5 @@ In most situations, the Secure Shell protocol is preferred over TELNET.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/unbound-all.ucl b/release/packages/ucl/unbound-all.ucl
index 40a292bc9685..e66f00be16a7 100644
--- a/release/packages/ucl/unbound-all.ucl
+++ b/release/packages/ucl/unbound-all.ucl
@@ -31,5 +31,5 @@ EOD
 licenses = [ BSD4CLAUSE ]
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/release/packages/ucl/yp-all.ucl b/release/packages/ucl/yp-all.ucl
index 0cdea7e130c4..f361f319b730 100644
--- a/release/packages/ucl/yp-all.ucl
+++ b/release/packages/ucl/yp-all.ucl
@@ -26,5 +26,5 @@ utilities and a sample Makefile for building the YP database.
 EOD
 
 annotations {
-	set = "base,base-jail"
+	set = "optional,optional-jail"
 }
diff --git a/usr.sbin/bsdinstall/scripts/pkgbase.in b/usr.sbin/bsdinstall/scripts/pkgbase.in
index 0b7554644028..d02d89b23865 100755
--- a/usr.sbin/bsdinstall/scripts/pkgbase.in
+++ b/usr.sbin/bsdinstall/scripts/pkgbase.in
@@ -79,7 +79,8 @@ local function select_components(components, options)
 	local descriptions = {
 		["kernel-dbg"] = "Debug symbols for the kernel",
 		["devel"] = "C/C++ compilers and related utilities",
-		["base"] = "The complete base system (includes devel)",
+		["optional"] = "Optional software (excluding compilers)",
+		["base"] = "The complete base system (includes devel and optional)",
 		["src"] = "System source tree",
 		["tests"] = "Test suite",
 		["lib32"] = "32-bit compatibility libraries",