Index: etc/mtree/BSD.usr.dist
===================================================================
--- etc/mtree/BSD.usr.dist
+++ etc/mtree/BSD.usr.dist
@@ -201,9 +201,9 @@
             ..
         ..
         certs
-            blacklisted
+            blacklisted tags=package=caroot
             ..
-            trusted
+            trusted tags=package=caroot
             ..
         ..
         dict
Index: release/packages/caroot.ucl
===================================================================
--- /dev/null
+++ release/packages/caroot.ucl
@@ -0,0 +1,25 @@
+#
+# $FreeBSD$
+#
+
+name = "FreeBSD-%PKGNAME%"
+origin = "base"
+version = "%VERSION%"
+comment = "%COMMENT%"
+categories = [ base ]
+maintainer = "re@FreeBSD.org"
+www = "https://www.FreeBSD.org"
+prefix = "/"
+licenselogic = "single"
+licenses = [ BSD2CLAUSE ]
+desc = <<EOD
+%DESC%
+EOD
+scripts: {
+	# XXX If pkg picks up a mechanism to detect in the post-install script
+	# files being added or removed, we should use it instead to gate the
+	# rehash.
+	post-install = <<EOD
+	[ -x /usr/sbin/certctl ] && /usr/sbin/certctl rehash
+EOD
+}
Index: secure/caroot/Makefile
===================================================================
--- secure/caroot/Makefile
+++ secure/caroot/Makefile
@@ -1,7 +1,5 @@
 # $FreeBSD$
 
-PACKAGE=	caroot
-
 CLEANFILES+=	certdata.txt
 
 SUBDIR+=	trusted
Index: secure/caroot/Makefile.inc
===================================================================
--- /dev/null
+++ secure/caroot/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+PACKAGE=	caroot