9 files changed, 140 insertions, 3 deletions
diff --git a/release/packages/ucl/bsdinstall.ucl b/release/packages/ucl/bsdinstall.ucl
index 7fe8898b9427..96ff220bfb54 100644
--- a/release/packages/ucl/bsdinstall.ucl
+++ b/release/packages/ucl/bsdinstall.ucl
@@ -21,4 +21,9 @@ deps {
 	"runtime" {
 		version = "${VERSION}"
 	},
+
+	# the pkgbase script requires flua
+	"flua" {
+		version = "${VERSION}"
+	},
 }
diff --git a/release/packages/ucl/caroot.ucl b/release/packages/ucl/caroot.ucl
index e43c9d0771f2..f7d0dd8acb7f 100644
--- a/release/packages/ucl/caroot.ucl
+++ b/release/packages/ucl/caroot.ucl
@@ -4,6 +4,6 @@ deps {
 	}
 }
 scripts: {
-	post-install = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ rehash"
-	post-uninstall = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ rehash"
+	post-install = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ ${PKG_METALOG:+-U -M $PKG_METALOG} rehash"
+	post-uninstall = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ ${PKG_METALOG:+-U -M $PKG_METALOG} rehash"
 }
diff --git a/release/packages/ucl/dhclient-all.ucl b/release/packages/ucl/dhclient-all.ucl
index bae3c7d7c413..b540a23eeb71 100644
--- a/release/packages/ucl/dhclient-all.ucl
+++ b/release/packages/ucl/dhclient-all.ucl
@@ -46,5 +46,5 @@ EOD
 licenses = [ "BSD-3-Clause" ]
 
 annotations {
-	set = minimal
+	set = "minimal,minimal-jail"
 }
diff --git a/release/packages/ucl/dhclient.ucl b/release/packages/ucl/dhclient.ucl
new file mode 100644
index 000000000000..f15ca8703edf
--- /dev/null
+++ b/release/packages/ucl/dhclient.ucl
@@ -0,0 +1,26 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+deps {
+	# dhclient uses resolvconf to update /etc/resolv.conf in case the
+	# DHCP server returns nameserver addresses.
+	"resolvconf" {
+		version = "${VERSION}"
+	},
+}
+
diff --git a/release/packages/ucl/flua-all.ucl b/release/packages/ucl/flua-all.ucl
new file mode 100644
index 000000000000..7488e2e36839
--- /dev/null
+++ b/release/packages/ucl/flua-all.ucl
@@ -0,0 +1,32 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Private Lua implementation"
+
+desc = <<EOD
+flua(1) is an implementation of Lua for use by the base system.  This facility
+is not intended for general use, and may be modified or removed at any time
+without notice.
+
+Supported versions of Lua for general use are available in the FreeBSD Ports
+Collection.
+EOD
+
+annotations {
+	set = "optional,optional-jail"
+}
diff --git a/release/packages/ucl/local-unbound.ucl b/release/packages/ucl/local-unbound.ucl
index 0f1c77a0d0ee..34d4c3664c9e 100644
--- a/release/packages/ucl/local-unbound.ucl
+++ b/release/packages/ucl/local-unbound.ucl
@@ -25,3 +25,11 @@ by running "service local_unbound setup" before restarting the service.
 EOM
 	}
 ]
+
+deps {
+	# local-unbound uses resolvconf to update resolv.conf and to generate
+	# its forward.conf.
+	"resolvconf" {
+		version = "${VERSION}"
+	},
+}
diff --git a/release/packages/ucl/nuageinit-all.ucl b/release/packages/ucl/nuageinit-all.ucl
index c9913f8cfb88..8c7a0754040c 100644
--- a/release/packages/ucl/nuageinit-all.ucl
+++ b/release/packages/ucl/nuageinit-all.ucl
@@ -27,6 +27,13 @@ loaded from a local disk or CD-ROM.
 nuageinit implements the cloud-init (https://cloud-init.io/) specification.
 EOD
 
+deps {
+	# nuageinit is written in Lua
+	"flua" {
+		version = "${VERSION}"
+	},
+}
+
 annotations {
 	set = minimal
 }
diff --git a/release/packages/ucl/tests.ucl b/release/packages/ucl/tests.ucl
new file mode 100644
index 000000000000..bac72f1534d3
--- /dev/null
+++ b/release/packages/ucl/tests.ucl
@@ -0,0 +1,27 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+deps {
+	# Quite a few tests require flua.
+	"flua" {
+		version = "${VERSION}"
+	},
+}
+
+
diff --git a/release/packages/ucl/zlib-all.ucl b/release/packages/ucl/zlib-all.ucl
new file mode 100644
index 000000000000..d7596c698e39
--- /dev/null
+++ b/release/packages/ucl/zlib-all.ucl
@@ -0,0 +1,32 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "DEFLATE (gzip) data compression library"
+
+desc = <<EOD
+zlib implements the DEFLATE data compression algorithm, as used in the
+GNU gzip(1) utility.  DEFLATE is widely used in many situations, such
+as network protocols (including HTTP) that need to compress data in
+transit, and in utilities that compress data on disk.
+EOD
+
+licenses = [ "Zlib" ]
+
+annotations {
+	set = "minimal,minimal-jail"
+}