diff --git a/libexec/nuageinit/nuage.lua b/libexec/nuageinit/nuage.lua
index 116ab143ccfa..4e21405a443b 100644
--- a/libexec/nuageinit/nuage.lua
+++ b/libexec/nuageinit/nuage.lua
@@ -1,15 +1,25 @@
+---
 -- SPDX-License-Identifier: BSD-2-Clause
 --
 -- Copyright(c) 2022 Baptiste Daroussin <bapt@FreeBSD.org>
 
-local pu = require("posix.unistd")
+local unistd = require("posix.unistd")
+local sys_stat = require("posix.sys.stat")
+local lfs = require("lfs")
 
-local function warnmsg(str)
-	io.stderr:write(str.."\n")
+local function warnmsg(str, prepend)
+	if not str then
+		return
+	end
+	local tag = ""
+	if prepend ~= false then
+		tag = "nuageinit: "
+	end
+	io.stderr:write(tag .. str .. "\n")
 end
 
-local function errmsg(str)
-	io.stderr:write(str.."\n")
+local function errmsg(str, prepend)
+	warnmsg(str, prepend)
 	os.exit(1)
 end
 
@@ -28,15 +38,17 @@ local function mkdir_p(path)
 	if lfs.attributes(path, "mode") ~= nil then
 		return true
 	end
-	local r,err = mkdir_p(dirname(path))
+	local r, err = mkdir_p(dirname(path))
 	if not r then
-		return nil,err.." (creating "..path..")"
+		return nil, err .. " (creating " .. path .. ")"
 	end
 	return lfs.mkdir(path)
 end
 
 local function sethostname(hostname)
-	if hostname == nil then return end
+	if hostname == nil then
+		return
+	end
 	local root = os.getenv("NUAGE_FAKE_ROOTDIR")
 	if not root then
 		root = ""
@@ -44,12 +56,12 @@ local function sethostname(hostname)
 	local hostnamepath = root .. "/etc/rc.conf.d/hostname"
 
 	mkdir_p(dirname(hostnamepath))
-	local f,err = io.open(hostnamepath, "w")
+	local f, err = io.open(hostnamepath, "w")
 	if not f then
-		warnmsg("Impossible to open "..hostnamepath .. ":" ..err)
+		warnmsg("Impossible to open " .. hostnamepath .. ":" .. err)
 		return
 	end
-	f:write("hostname=\""..hostname.."\"\n")
+	f:write('hostname="' .. hostname .. '"\n')
 	f:close()
 end
 
@@ -62,7 +74,7 @@ local function splitlist(list)
 	elseif type(list) == "table" then
 		ret = list
 	else
-		warnmsg("Invalid type ".. type(list) ..", expecting table or string")
+		warnmsg("Invalid type " .. type(list) .. ", expecting table or string")
 	end
 	return ret
 end
@@ -77,7 +89,7 @@ local function adduser(pwd)
 	if root then
 		cmd = cmd .. "-R " .. root .. " "
 	end
-	local f = io.popen(cmd .. " usershow " ..pwd.name .. " -7 2>/dev/null")
+	local f = io.popen(cmd .. " usershow " .. pwd.name .. " -7 2> /dev/null")
 	local pwdstr = f:read("*a")
 	f:close()
 	if pwdstr:len() ~= 0 then
@@ -89,10 +101,10 @@ local function adduser(pwd)
 	if not pwd.homedir then
 		pwd.homedir = "/home/" .. pwd.name
 	end
-	local extraargs=""
+	local extraargs = ""
 	if pwd.groups then
 		local list = splitlist(pwd.groups)
-		extraargs = " -G ".. table.concat(list, ',')
+		extraargs = " -G " .. table.concat(list, ",")
 	end
 	-- pw will automatically create a group named after the username
 	-- do not add a -g option in this case
@@ -108,23 +120,23 @@ local function adduser(pwd)
 	local precmd = ""
 	local postcmd = ""
 	if pwd.passwd then
-		precmd = "echo "..pwd.passwd .. "| "
-		postcmd = " -H 0 "
+		precmd = "echo '" .. pwd.passwd .. "' | "
+		postcmd = " -H 0"
 	elseif pwd.plain_text_passwd then
-		precmd = "echo "..pwd.plain_text_passwd .. "| "
-		postcmd = " -h 0 "
+		precmd = "echo '" .. pwd.plain_text_passwd .. "' | "
+		postcmd = " -h 0"
 	end
 	cmd = precmd .. "pw "
 	if root then
 		cmd = cmd .. "-R " .. root .. " "
 	end
-	cmd = cmd .. "useradd -n ".. pwd.name .. " -M 0755 -w none "
-	cmd = cmd .. extraargs .. " -c '".. pwd.gecos
-	cmd = cmd .. "' -d '" .. pwd.homedir .. "' -s "..pwd.shell .. postcmd
+	cmd = cmd .. "useradd -n " .. pwd.name .. " -M 0755 -w none "
+	cmd = cmd .. extraargs .. " -c '" .. pwd.gecos
+	cmd = cmd .. "' -d '" .. pwd.homedir .. "' -s " .. pwd.shell .. postcmd
 
 	local r = os.execute(cmd)
 	if not r then
-		warnmsg("nuageinit: fail to add user "..pwd.name);
+		warnmsg("fail to add user " .. pwd.name)
 		warnmsg(cmd)
 		return nil
 	end
@@ -149,7 +161,7 @@ local function addgroup(grp)
 	if root then
 		cmd = cmd .. "-R " .. root .. " "
 	end
-	local f = io.popen(cmd .. " groupshow " ..grp.name .. " 2>/dev/null")
+	local f = io.popen(cmd .. " groupshow " .. grp.name .. " 2> /dev/null")
 	local grpstr = f:read("*a")
 	f:close()
 	if grpstr:len() ~= 0 then
@@ -158,16 +170,16 @@ local function addgroup(grp)
 	local extraargs = ""
 	if grp.members then
 		local list = splitlist(grp.members)
-		extraargs = " -M " .. table.concat(list, ',')
+		extraargs = " -M " .. table.concat(list, ",")
 	end
 	cmd = "pw "
 	if root then
 		cmd = cmd .. "-R " .. root .. " "
 	end
-	cmd = cmd .. "groupadd -n ".. grp.name .. extraargs
+	cmd = cmd .. "groupadd -n " .. grp.name .. extraargs
 	local r = os.execute(cmd)
 	if not r then
-		warnmsg("nuageinit: fail to add group ".. grp.name);
+		warnmsg("fail to add group " .. grp.name)
 		warnmsg(cmd)
 		return false
 	end
@@ -196,30 +208,30 @@ local function addsshkey(homedir, key)
 
 	local f = io.open(ak_path, "a")
 	if not f then
-		warnmsg("nuageinit: impossible to open "..ak_path)
+		warnmsg("impossible to open " .. ak_path)
 		return
 	end
 	f:write(key .. "\n")
 	f:close()
 	if chownak then
-		os.execute("chmod 0600 " .. ak_path)
-		pu.chown(ak_path, dirattrs.uid, dirattrs.gid)
+		sys_stat.chmod(ak_path, 384)
+		unistd.chown(ak_path, dirattrs.uid, dirattrs.gid)
 	end
 	if chowndotssh then
-		os.execute("chmod 0700 " .. dotssh_path)
-		pu.chown(dotssh_path, dirattrs.uid, dirattrs.gid)
+		sys_stat.chmod(dotssh_path, 448)
+		unistd.chown(dotssh_path, dirattrs.uid, dirattrs.gid)
 	end
 end
 
 local n = {
 	warn = warnmsg,
 	err = errmsg,
+	dirname = dirname,
+	mkdir_p = mkdir_p,
 	sethostname = sethostname,
 	adduser = adduser,
 	addgroup = addgroup,
-	addsshkey = addsshkey,
-	dirname = dirname,
-	mkdir_p = mkdir_p,
+	addsshkey = addsshkey
 }
 
 return n
diff --git a/libexec/nuageinit/nuageinit b/libexec/nuageinit/nuageinit
index 622e294bb531..c8f74d13b7fd 100755
--- a/libexec/nuageinit/nuageinit
+++ b/libexec/nuageinit/nuageinit
@@ -1,18 +1,18 @@
 #!/usr/libexec/flua
-
+---
 -- SPDX-License-Identifier: BSD-2-Clause-FreeBSD
 --
 -- Copyright(c) 2022 Baptiste Daroussin <bapt@FreeBSD.org>
 
 local nuage = require("nuage")
+local ucl = require("ucl")
 local yaml = require("yaml")
 
 if #arg ~= 2 then
-	nuage.err("Usage ".. arg[0] .." <cloud-init directory> [config-2|nocloud]")
+	nuage.err("Usage: " .. arg[0] .. " <cloud-init-directory> (<config-2> | <nocloud>)", false)
 end
 local path = arg[1]
 local citype = arg[2]
-local ucl = require("ucl")
 
 local default_user = {
 	name = "freebsd",
@@ -30,9 +30,9 @@ end
 
 local function open_config(name)
 	nuage.mkdir_p(root .. "/etc/rc.conf.d")
-	local f,err = io.open(root .. "/etc/rc.conf.d/" .. name, "w")
+	local f, err = io.open(root .. "/etc/rc.conf.d/" .. name, "w")
 	if not f then
-		nuage.err("nuageinit: unable to open "..name.." config: " .. err)
+		nuage.err("unable to open " .. name .. " config: " .. err)
 	end
 	return f
 end
@@ -40,17 +40,17 @@ end
 local function get_ifaces()
 	local parser = ucl.parser()
 	-- grab ifaces
-	local ns  = io.popen('netstat -i --libxo json')
+	local ns = io.popen("netstat -i --libxo json")
 	local netres = ns:read("*a")
 	ns:close()
-	local res,err = parser:parse_string(netres)
+	local res, err = parser:parse_string(netres)
 	if not res then
 		nuage.warn("Error parsing netstat -i --libxo json outout: " .. err)
 		return nil
 	end
 	local ifaces = parser:get_object()
 	local myifaces = {}
-	for _,iface in pairs(ifaces["statistics"]["interface"]) do
+	for _, iface in pairs(ifaces["statistics"]["interface"]) do
 		if iface["network"]:match("<Link#%d>") then
 			local s = iface["address"]
 			myifaces[s:lower()] = iface["name"]
@@ -67,20 +67,20 @@ local function config2_network(p)
 		return
 	end
 	f:close()
-	local res,err = parser:parse_file(p .. "/network_data.json")
+	local res, err = parser:parse_file(p .. "/network_data.json")
 	if not res then
-		nuage.warn("nuageinit: error parsing network_data.json: " .. err)
+		nuage.warn("error parsing network_data.json: " .. err)
 		return
 	end
 	local obj = parser:get_object()
 
 	local ifaces = get_ifaces()
 	if not ifaces then
-		nuage.warn("nuageinit: no network interfaces found")
+		nuage.warn("no network interfaces found")
 		return
 	end
 	local mylinks = {}
-	for _,v in pairs(obj["links"]) do
+	for _, v in pairs(obj["links"]) do
 		local s = v["ethernet_mac_address"]:lower()
 		mylinks[v["id"]] = ifaces[s]
 	end
@@ -91,66 +91,72 @@ local function config2_network(p)
 	local ipv6 = {}
 	local ipv6_routes = {}
 	local ipv4 = {}
-	for _,v in pairs(obj["networks"]) do
+	for _, v in pairs(obj["networks"]) do
 		local interface = mylinks[v["link"]]
 		if v["type"] == "ipv4_dhcp" then
-			network:write("ifconfig_"..interface.."=\"DHCP\"\n")
+			network:write("ifconfig_" .. interface .. '="DHCP"\n')
 		end
 		if v["type"] == "ipv4" then
-			network:write("ifconfig_"..interface.."=\"inet "..v["ip_address"].." netmask " .. v["netmask"] .. "\"\n")
+			network:write(
+				"ifconfig_" .. interface .. '="inet ' .. v["ip_address"] .. " netmask " .. v["netmask"] .. '"\n'
+			)
 			if v["gateway"] then
-				routing:write("defaultrouter=\""..v["gateway"].."\"\n")
+				routing:write('defaultrouter="' .. v["gateway"] .. '"\n')
 			end
 			if v["routes"] then
-				for i,r in ipairs(v["routes"]) do
+				for i, r in ipairs(v["routes"]) do
 					local rname = "cloudinit" .. i .. "_" .. interface
-					if v["gateway"] and v["gateway"] == r["gateway"] then goto next end
-					if r["network"] == "0.0.0.0" then
-						routing:write("defaultrouter=\""..r["gateway"].."\"\n")
+					if v["gateway"] and v["gateway"] == r["gateway"] then
 						goto next
 					end
-					routing:write("route_".. rname .. "=\"-net ".. r["network"] .. " ")
-					routing:write(r["gateway"] .. " " .. r["netmask"] .. "\"\n")
+					if r["network"] == "0.0.0.0" then
+						routing:write('defaultrouter="' .. r["gateway"] .. '"\n')
+						goto next
+					end
+					routing:write("route_" .. rname .. '="-net ' .. r["network"] .. " ")
+					routing:write(r["gateway"] .. " " .. r["netmask"] .. '"\n')
 					ipv4[#ipv4 + 1] = rname
 					::next::
 				end
 			end
 		end
 		if v["type"] == "ipv6" then
-			ipv6[#ipv6+1] = interface
-			ipv6_routes[#ipv6_routes+1] = interface
-			network:write("ifconfig_"..interface.."_ipv6=\"inet6 "..v["ip_address"].."\"\n")
+			ipv6[#ipv6 + 1] = interface
+			ipv6_routes[#ipv6_routes + 1] = interface
+			network:write("ifconfig_" .. interface .. '_ipv6="inet6 ' .. v["ip_address"] .. '"\n')
 			if v["gateway"] then
-				routing:write("ipv6_defaultrouter=\""..v["gateway"].."\"\n")
-				routing:write("ipv6_route_"..interface.."=\""..v["gateway"])
-				routing:write(" -prefixlen 128 -interface "..interface.."\"\n")
+				routing:write('ipv6_defaultrouter="' .. v["gateway"] .. '"\n')
+				routing:write("ipv6_route_" .. interface .. '="' .. v["gateway"])
+				routing:write(" -prefixlen 128 -interface " .. interface .. '"\n')
 			end
 			-- TODO compute the prefixlen for the routes
 			--if v["routes"] then
-			--	for i,r in ipairs(v["routes"]) do
+			--	for i, r in ipairs(v["routes"]) do
 			--	local rname = "cloudinit" .. i .. "_" .. mylinks[v["link"]]
 			--		-- skip all the routes which are already covered by the default gateway, some provider
 			--		-- still list plenty of them.
-			--		if v["gateway"] == r["gateway"] then goto next end
-			--		routing:write("ipv6_route_" .. rname .. "\"\n")
-			--		ipv6_routes[#ipv6_routes+1] = rname
+			--		if v["gateway"] == r["gateway"] then
+			--			goto next
+			--		end
+			--		routing:write("ipv6_route_" .. rname .. '"\n')
+			--		ipv6_routes[#ipv6_routes + 1] = rname
 			--		::next::
 			--	end
 			--end
 		end
 	end
 	if #ipv4 > 0 then
-		routing:write("static_routes=\"")
-		routing:write(table.concat(ipv4, " ") .. "\"\n")
+		routing:write('static_routes="')
+		routing:write(table.concat(ipv4, " ") .. '"\n')
 	end
 	if #ipv6 > 0 then
-		network:write("ipv6_network_interfaces=\"")
-		network:write(table.concat(ipv6, " ") .. "\"\n")
-		network:write("ipv6_default_interface=\""..ipv6[1].."\"\n")
+		network:write('ipv6_network_interfaces="')
+		network:write(table.concat(ipv6, " ") .. '"\n')
+		network:write('ipv6_default_interface="' .. ipv6[1] .. '"\n')
 	end
 	if #ipv6_routes > 0 then
-		routing:write("ipv6_static_routes=\"")
-		routing:write(table.concat(ipv6, " ") .. "\"\n")
+		routing:write('ipv6_static_routes="')
+		routing:write(table.concat(ipv6, " ") .. '"\n')
 	end
 	network:close()
 	routing:close()
@@ -158,10 +164,10 @@ end
 
 if citype == "config-2" then
 	local parser = ucl.parser()
-	local res,err = parser:parse_file(path..'/meta_data.json')
+	local res, err = parser:parse_file(path .. "/meta_data.json")
 
 	if not res then
-		nuage.err("nuageinit: error parsing config-2: meta_data.json: " .. err)
+		nuage.err("error parsing config-2 meta_data.json: " .. err)
 	end
 	local obj = parser:get_object()
 	if obj.public_keys then
@@ -175,32 +181,32 @@ if citype == "config-2" then
 	-- network
 	config2_network(path)
 elseif citype == "nocloud" then
-	local f,err = io.open(path.."/meta-data")
+	local f, err = io.open(path .. "/meta-data")
 	if err then
-		nuage.err("nuageinit: error parsing nocloud meta-data: ".. err)
+		nuage.err("error parsing nocloud meta-data: " .. err)
 	end
 	local obj = yaml.eval(f:read("*a"))
 	f:close()
 	if not obj then
-		nuage.err("nuageinit: error parsing nocloud meta-data")
+		nuage.err("error parsing nocloud meta-data")
 	end
-	local hostname = obj['local-hostname']
+	local hostname = obj["local-hostname"]
 	if not hostname then
-		hostname = obj['hostname']
+		hostname = obj["hostname"]
 	end
 	if hostname then
 		nuage.sethostname(hostname)
 	end
 else
-	nuage.err("Unknown cloud init type: ".. citype)
+	nuage.err("Unknown cloud init type: " .. citype)
 end
 
 -- deal with user-data
 local ud = nil
 local f = nil
-userdatas = { "user-data", "user_data" }
-for _,v in pairs(userdatas) do
-	f = io.open(path..'/' .. v, "r")
+userdatas = {"user-data", "user_data"}
+for _, v in pairs(userdatas) do
+	f = io.open(path .. "/" .. v, "r")
 	if f then
 		ud = v
 		break
@@ -209,33 +215,33 @@ end
 if not f then
 	os.exit(0)
 end
-local line = f:read('*l')
+local line = f:read("*l")
 f:close()
 if line == "#cloud-config" then
-	f = io.open(path.."/" .. ud)
+	f = io.open(path .. "/" .. ud)
 	local obj = yaml.eval(f:read("*a"))
 	f:close()
 	if not obj then
-		nuage.err("nuageinit: error parsing cloud-config file: " .. ud)
+		nuage.err("error parsing cloud-config file: " .. ud)
 	end
 	if obj.groups then
-		for n,g in pairs(obj.groups) do
+		for n, g in pairs(obj.groups) do
 			if (type(g) == "string") then
 				local r = nuage.addgroup({name = g})
 				if not r then
-					nuage.warn("nuageinit: failed to add group: ".. g)
+					nuage.warn("failed to add group: " .. g)
 				end
 			elseif type(g) == "table" then
-				for k,v in pairs(g) do
+				for k, v in pairs(g) do
 					nuage.addgroup({name = k, members = v})
 				end
 			else
-				nuage.warn("nuageinit: invalid type : "..type(g).." for users entry number "..n);
+				nuage.warn("invalid type: " .. type(g) .. " for users entry number " .. n)
 			end
 		end
 	end
 	if obj.users then
-		for n,u in pairs(obj.users) do
+		for n, u in pairs(obj.users) do
 			if type(u) == "string" then
 				if u == "default" then
 					nuage.adduser(default_user)
@@ -249,12 +255,12 @@ if line == "#cloud-config" then
 				end
 				local homedir = nuage.adduser(u)
 				if u.ssh_authorized_keys then
-					for _,v in ipairs(u.ssh_authorized_keys) do
+					for _, v in ipairs(u.ssh_authorized_keys) do
 						nuage.addsshkey(homedir, v)
 					end
 				end
 			else
-				nuage.warn("nuageinit: invalid type : "..type(u).." for users entry number "..n);
+				nuage.warn("invalid type : " .. type(u) .. " for users entry number " .. n)
 			end
 			::unext::
 		end
@@ -264,7 +270,7 @@ if line == "#cloud-config" then
 	end
 	if obj.ssh_authorized_keys then
 		local homedir = nuage.adduser(default_user)
-		for _,k in ipairs(obj.ssh_authorized_keys) do
+		for _, k in ipairs(obj.ssh_authorized_keys) do
 			nuage.addsshkey(homedir, k)
 		end
 	end
@@ -273,48 +279,52 @@ if line == "#cloud-config" then
 		nuage.mkdir_p(root .. "/etc/rc.conf.d")
 		local network = open_config("network")
 		local routing = open_config("routing")
-		local ipv6={}
-		for _,v in pairs(obj.network.ethernets) do
-			if not v.match then goto next end
-			if not v.match.macaddress then goto next end
+		local ipv6 = {}
+		for _, v in pairs(obj.network.ethernets) do
+			if not v.match then
+				goto next
+			end
+			if not v.match.macaddress then
+				goto next
+			end
 			if not ifaces[v.match.macaddress] then
-				nuage.warn("nuageinit: not interface matching: "..v.match.macaddress)
+				nuage.warn("not interface matching: " .. v.match.macaddress)
 				goto next
 			end
 			local interface = ifaces[v.match.macaddress]
 			if v.dhcp4 then
-				network:write("ifconfig_"..interface.."=\"DHCP\"\n")
+				network:write("ifconfig_" .. interface .. '="DHCP"\n')
 			elseif v.addresses then
-				for _,a in pairs(v.addresses) do
+				for _, a in pairs(v.addresses) do
 					if a:match("^(%d+)%.(%d+)%.(%d+)%.(%d+)") then
-						network:write("ifconfig_"..interface.."=\"inet "..a.."\"\n")
+						network:write("ifconfig_" .. interface .. '="inet ' .. a .. '"\n')
 					else
-						network:write("ifconfig_"..interface.."_ipv6=\"inet6 "..a.."\"\n")
-						ipv6[#ipv6 +1] = interface
+						network:write("ifconfig_" .. interface .. '_ipv6="inet6 ' .. a .. '"\n')
+						ipv6[#ipv6 + 1] = interface
 					end
 				end
 			end
 			if v.gateway4 then
-				routing:write("defaultrouter=\""..v.gateway4.."\"\n")
+				routing:write('defaultrouter="' .. v.gateway4 .. '"\n')
 			end
 			if v.gateway6 then
-				routing:write("ipv6_defaultrouter=\""..v.gateway6.."\"\n")
-				routing:write("ipv6_route_"..interface.."=\""..v.gateway6)
-				routing:write(" -prefixlen 128 -interface "..interface.."\"\n")
+				routing:write('ipv6_defaultrouter="' .. v.gateway6 .. '"\n')
+				routing:write("ipv6_route_" .. interface .. '="' .. v.gateway6)
+				routing:write(" -prefixlen 128 -interface " .. interface .. '"\n')
 			end
 			::next::
 		end
 		if #ipv6 > 0 then
-			network:write("ipv6_network_interfaces=\"")
-			network:write(table.concat(ipv6, " ") .. "\"\n")
-			network:write("ipv6_default_interface=\""..ipv6[1].."\"\n")
+			network:write('ipv6_network_interfaces="')
+			network:write(table.concat(ipv6, " ") .. '"\n')
+			network:write('ipv6_default_interface="' .. ipv6[1] .. '"\n')
 		end
 		network:close()
 		routing:close()
 	end
 else
-	local res,err = os.execute(path..'/' .. ud)
+	local res, err = os.execute(path .. "/" .. ud)
 	if not res then
-		nuage.err("nuageinit: error executing user-data script: ".. err)
+		nuage.err("error executing user-data script: " .. err)
 	end
 end
diff --git a/libexec/nuageinit/tests/Makefile b/libexec/nuageinit/tests/Makefile
index d5b3bd9dcc82..ccb81c090445 100644
--- a/libexec/nuageinit/tests/Makefile
+++ b/libexec/nuageinit/tests/Makefile
@@ -2,12 +2,12 @@ PACKAGE=	tests
 
 ATF_TESTS_SH=	nuage utils nuageinit
 
-${PACKAGE}FILES+=	warn.lua
-${PACKAGE}FILES+=	err.lua
-${PACKAGE}FILES+=	dirname.lua
-${PACKAGE}FILES+=	sethostname.lua
+${PACKAGE}FILES+=	addgroup.lua
 ${PACKAGE}FILES+=	addsshkey.lua
 ${PACKAGE}FILES+=	adduser.lua
-${PACKAGE}FILES+=	addgroup.lua
+${PACKAGE}FILES+=	dirname.lua
+${PACKAGE}FILES+=	err.lua
+${PACKAGE}FILES+=	sethostname.lua
+${PACKAGE}FILES+=	warn.lua
 
 .include <bsd.test.mk>
diff --git a/libexec/nuageinit/tests/addgroup.lua b/libexec/nuageinit/tests/addgroup.lua
index 60a0d8346793..a36a5e24c7b3 100644
--- a/libexec/nuageinit/tests/addgroup.lua
+++ b/libexec/nuageinit/tests/addgroup.lua
@@ -1,6 +1,7 @@
 #!/usr/libexec/flua
 
 local n = require("nuage")
+
 if n.addgroup() then
 	n.err("addgroup should not accept empty value")
 end
diff --git a/libexec/nuageinit/tests/addsshkey.lua b/libexec/nuageinit/tests/addsshkey.lua
index 3aa5f7619ec2..47e102c162a9 100644
--- a/libexec/nuageinit/tests/addsshkey.lua
+++ b/libexec/nuageinit/tests/addsshkey.lua
@@ -1,2 +1,5 @@
+#!/usr/libexec/flua
+
 local n = require("nuage")
+
 n.addsshkey(".", "mykey")
diff --git a/libexec/nuageinit/tests/adduser.lua b/libexec/nuageinit/tests/adduser.lua
index 9366d2abd0f4..cef6be0c0e0c 100644
--- a/libexec/nuageinit/tests/adduser.lua
+++ b/libexec/nuageinit/tests/adduser.lua
@@ -1,6 +1,7 @@
 #!/usr/libexec/flua
 
 local n = require("nuage")
+
 if n.adduser() then
 	n.err("adduser should not accept empty value")
 end
diff --git a/libexec/nuageinit/tests/dirname.lua b/libexec/nuageinit/tests/dirname.lua
index d1268e48575c..7e3a2c835502 100644
--- a/libexec/nuageinit/tests/dirname.lua
+++ b/libexec/nuageinit/tests/dirname.lua
@@ -1,8 +1,11 @@
+#!/usr/libexec/flua
+
 local n = require("nuage")
+
 print(n.dirname("/my/path/path1"))
 if n.dirname("path") then
-	nuage.err("Expecting nil for n.dirname(\"path\")")
+	n.err('Expecting nil for n.dirname("path")')
 end
 if n.dirname() then
-	nuage.err("Expecting nil for n.dirname")
+	n.err("Expecting nil for n.dirname")
 end
diff --git a/libexec/nuageinit/tests/err.lua b/libexec/nuageinit/tests/err.lua
index c62fa1098f09..567d4f2df66e 100644
--- a/libexec/nuageinit/tests/err.lua
+++ b/libexec/nuageinit/tests/err.lua
@@ -1,4 +1,5 @@
 #!/usr/libexec/flua
 
 local n = require("nuage")
+
 n.err("plop")
diff --git a/libexec/nuageinit/tests/nuage.sh b/libexec/nuageinit/tests/nuage.sh
index 29842bff3d6b..293a0a4a9a83 100644
--- a/libexec/nuageinit/tests/nuage.sh
+++ b/libexec/nuageinit/tests/nuage.sh
@@ -1,10 +1,18 @@
+#-
+# Copyright (c) 2022 Baptiste Daroussin <bapt@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+export NUAGE_FAKE_ROOTDIR="$PWD"
+
 atf_test_case sethostname
 atf_test_case addsshkey
 atf_test_case adduser
 atf_test_case addgroup
 
-sethostname_body() {
-	export NUAGE_FAKE_ROOTDIR="$(pwd)"
+sethostname_body()
+{
 	atf_check /usr/libexec/flua $(atf_get_srcdir)/sethostname.lua
 	if [ ! -f etc/rc.conf.d/hostname ]; then
 		atf_fail "hostname not written"
@@ -12,7 +20,8 @@ sethostname_body() {
 	atf_check -o inline:"hostname=\"myhostname\"\n" cat etc/rc.conf.d/hostname
 }
 
-addsshkey_body() {
+addsshkey_body()
+{
 	atf_check /usr/libexec/flua $(atf_get_srcdir)/addsshkey.lua
 	if [ ! -f .ssh/authorized_keys ]; then
 		atf_fail "ssh key not added"
@@ -24,29 +33,31 @@ addsshkey_body() {
 	atf_check -o inline:"mykey\nmykey\n" cat .ssh/authorized_keys
 }
 
-adduser_body() {
-	export NUAGE_FAKE_ROOTDIR="$(pwd)"
-	if [ $(id -u) -ne 0 ]; then
-		atf_skip "root required"
-	fi
+adduser_head()
+{
+	atf_set "require.user" root
+}
+adduser_body()
+{
 	mkdir etc
-	printf "root:*:0:0::0:0:Charlie &:/root:/bin/csh\n" > etc/master.passwd
+	printf "root:*:0:0::0:0:Charlie &:/root:/bin/sh\n" > etc/master.passwd
 	pwd_mkdb -d etc etc/master.passwd
 	printf "wheel:*:0:root\n" > etc/group
-	atf_check -e inline:"Argument should be a table\nArgument should be a table\n" /usr/libexec/flua $(atf_get_srcdir)/adduser.lua
+	atf_check -e inline:"nuageinit: Argument should be a table\nnuageinit: Argument should be a table\n" /usr/libexec/flua $(atf_get_srcdir)/adduser.lua
 	test -d home/impossible_username || atf_fail "home not created"
 	atf_check -o inline:"impossible_username::1001:1001::0:0:impossible_username User:/home/impossible_username:/bin/sh\n" grep impossible_username etc/master.passwd
 }
 
-addgroup_body() {
-	export NUAGE_FAKE_ROOTDIR="$(pwd)"
+addgroup_body()
+{
 	mkdir etc
 	printf "wheel:*:0:root\n" > etc/group
-	atf_check -e inline:"Argument should be a table\nArgument should be a table\n" /usr/libexec/flua $(atf_get_srcdir)/addgroup.lua
+	atf_check -e inline:"nuageinit: Argument should be a table\nnuageinit: Argument should be a table\n" /usr/libexec/flua $(atf_get_srcdir)/addgroup.lua
 	atf_check -o inline:"impossible_groupname:*:1001:\n" grep impossible_groupname etc/group
 }
 
-atf_init_test_cases() {
+atf_init_test_cases()
+{
 	atf_add_test_case sethostname
 	atf_add_test_case addsshkey
 	atf_add_test_case adduser
diff --git a/libexec/nuageinit/tests/nuageinit.sh b/libexec/nuageinit/tests/nuageinit.sh
index b5078e256853..f7f39ce32ad8 100644
--- a/libexec/nuageinit/tests/nuageinit.sh
+++ b/libexec/nuageinit/tests/nuageinit.sh
@@ -1,8 +1,15 @@
+#-
+# Copyright (c) 2022 Baptiste Daroussin <bapt@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+export NUAGE_FAKE_ROOTDIR="$PWD"
+
 atf_test_case args
 atf_test_case nocloud
 atf_test_case nocloud_userdata_script
 atf_test_case nocloud_user_data_script
-atf_test_case nocloud_userdata_cloudconfig
 atf_test_case nocloud_userdata_cloudconfig_users
 atf_test_case nocloud_network
 atf_test_case config2
@@ -12,72 +19,66 @@ atf_test_case config2_pubkeys_meta_data
 atf_test_case config2_network
 atf_test_case config2_network_static_v4
 
-
 args_body()
 {
-	atf_check -s exit:1 -e inline:"Usage /usr/libexec/nuageinit <cloud-init directory> [config-2|nocloud]\n" /usr/libexec/nuageinit
-	atf_check -s exit:1 -e inline:"Usage /usr/libexec/nuageinit <cloud-init directory> [config-2|nocloud]\n" /usr/libexec/nuageinit bla
-	atf_check -s exit:1 -e inline:"Usage /usr/libexec/nuageinit <cloud-init directory> [config-2|nocloud]\n" /usr/libexec/nuageinit bla meh plop
-	atf_check -s exit:1 -e inline:"Unknown cloud init type: meh\n" /usr/libexec/nuageinit bla meh
+	atf_check -s exit:1 -e inline:"Usage: /usr/libexec/nuageinit <cloud-init-directory> (<config-2> | <nocloud>)\n" /usr/libexec/nuageinit
+	atf_check -s exit:1 -e inline:"Usage: /usr/libexec/nuageinit <cloud-init-directory> (<config-2> | <nocloud>)\n" /usr/libexec/nuageinit bla
+	atf_check -s exit:1 -e inline:"Usage: /usr/libexec/nuageinit <cloud-init-directory> (<config-2> | <nocloud>)\n" /usr/libexec/nuageinit bla meh plop
+	atf_check -s exit:1 -e inline:"nuageinit: Unknown cloud init type: meh\n" /usr/libexec/nuageinit bla meh
 }
 
 nocloud_body()
 {
-	here=$(pwd)
 	mkdir -p media/nuageinit
-	atf_check -s exit:1 -e match:"nuageinit: error parsing nocloud.*" /usr/libexec/nuageinit ${here}/media/nuageinit/ nocloud
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	printf "instance-id: iid-local01\nlocal-hostname: cloudimg\n" > ${here}/media/nuageinit/meta-data
-	atf_check -s exit:0 /usr/libexec/nuageinit ${here}/media/nuageinit nocloud
+	atf_check -s exit:1 -e match:"nuageinit: error parsing nocloud.*" /usr/libexec/nuageinit "${PWD}"/media/nuageinit/ nocloud
+	printf "instance-id: iid-local01\nlocal-hostname: cloudimg\n" > "${PWD}"/media/nuageinit/meta-data
+	atf_check -s exit:0 /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"hostname=\"cloudimg\"\n" cat etc/rc.conf.d/hostname
 	cat > media/nuageinit/meta-data << EOF
 instance-id: iid-local01
 hostname: myhost
 EOF
-	atf_check -s exit:0 /usr/libexec/nuageinit ${here}/media/nuageinit nocloud
+	atf_check -s exit:0 /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"hostname=\"myhost\"\n" cat etc/rc.conf.d/hostname
 }
 
 nocloud_userdata_script_body()
 {
-	here=$(pwd)
 	mkdir -p media/nuageinit
-	printf "instance-id: iid-local01\n" > ${here}/media/nuageinit/meta-data
-	printf "#!/bin/sh\necho "yeah"\n" > ${here}/media/nuageinit/user-data
-	chmod 755  ${here}/media/nuageinit/user-data
-	atf_check -s exit:0 -o inline:"yeah\n" /usr/libexec/nuageinit ${here}/media/nuageinit nocloud
+	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
+	printf "#!/bin/sh\necho yeah\n" > "${PWD}"/media/nuageinit/user-data
+	chmod 755 "${PWD}"/media/nuageinit/user-data
+	atf_check -s exit:0 -o inline:"yeah\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 }
 
 nocloud_user_data_script_body()
 {
-	here=$(pwd)
 	mkdir -p media/nuageinit
-	printf "instance-id: iid-local01\n" > ${here}/media/nuageinit/meta-data
-	printf "#!/bin/sh\necho "yeah"\n" > ${here}/media/nuageinit/user_data
-	chmod 755  ${here}/media/nuageinit/user_data
-	atf_check -s exit:0 -o inline:"yeah\n" /usr/libexec/nuageinit ${here}/media/nuageinit nocloud
+	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
+	printf "#!/bin/sh\necho yeah\n" > "${PWD}"/media/nuageinit/user_data
+	chmod 755 "${PWD}"/media/nuageinit/user_data
+	atf_check -s exit:0 -o inline:"yeah\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 }
 
+nocloud_userdata_cloudconfig_users_head()
+{
+	atf_set "require.user" root
+}
 nocloud_userdata_cloudconfig_users_body()
 {
-	here=$(pwd)
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	if [ $(id -u) -ne 0 ]; then
-		atf_skip "root required"
-	fi
 	mkdir -p media/nuageinit
-	printf "instance-id: iid-local01\n" > ${here}/media/nuageinit/meta-data
+	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	mkdir -p etc
-	cat > etc/master.passwd <<EOF
-root:*:0:0::0:0:Charlie &:/root:/bin/csh
-sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
+	cat > etc/master.passwd << EOF
+root:*:0:0::0:0:Charlie &:/root:/bin/sh
+sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
-	pwd_mkdb -d etc ${here}/etc/master.passwd
-	cat > etc/group <<EOF
+	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
+	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
-	cat > media/nuageinit/user-data <<EOF
+	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 groups:
   - admingroup: [root,sys]
@@ -90,7 +91,7 @@ users:
     groups: users
     passwd: $6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/
 EOF
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit nocloud
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	cat > expectedgroup << EOF
 wheel:*:0:root,freebsd
 users:*:1:foobar
@@ -99,34 +100,34 @@ cloud-users:*:1002:
 freebsd:*:1003:
 foobar:*:1004:
 EOF
-	cat > expectedpasswd << EOF
-root:*:0:0::0:0:Charlie &:/root:/bin/csh
-sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
+	cat > expectedpasswd << 'EOF'
+root:*:0:0::0:0:Charlie &:/root:/bin/sh
+sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 freebsd:freebsd:1001:1003::0:0:FreeBSD User:/home/freebsd:/bin/sh
-foobar:H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/:1002:1004::0:0:Foo B. Bar:/home/foobar:/bin/sh
+foobar:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/:1002:1004::0:0:Foo B. Bar:/home/foobar:/bin/sh
 EOF
-	sed -i "" "s/freebsd:.*:1001/freebsd:freebsd:1001/" ${here}/etc/master.passwd
-	atf_check -o file:expectedpasswd cat ${here}/etc/master.passwd
-	atf_check -o file:expectedgroup cat ${here}/etc/group
+	sed -i "" "s/freebsd:.*:1001/freebsd:freebsd:1001/" "${PWD}"/etc/master.passwd
+	atf_check -o file:expectedpasswd cat "${PWD}"/etc/master.passwd
+	atf_check -o file:expectedgroup cat "${PWD}"/etc/group
 }
 
+nocloud_network_head()
+{
+	atf_set "require.user" root
+}
 nocloud_network_body()
 {
-	here=$(pwd)
 	mkdir -p media/nuageinit
 	mkdir -p etc
-	cat > etc/master.passwd <<EOF
-root:*:0:0::0:0:Charlie &:/root:/bin/csh
-sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
+	cat > etc/master.passwd << EOF
+root:*:0:0::0:0:Charlie &:/root:/bin/sh
+sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
-	pwd_mkdb -d etc ${here}/etc/master.passwd
-	cat > etc/group <<EOF
+	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
+	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
-	if [ $(id -u) -ne 0 ]; then
-		atf_skip "root required"
-	fi
 	mynetworks=$(ifconfig -l ether)
 	if [ -z "$mynetworks" ]; then
 		atf_skip "a network interface is needed"
@@ -134,112 +135,104 @@ EOF
 	set -- $mynetworks
 	myiface=$1
 	myaddr=$(ifconfig $myiface ether | awk '/ether/ { print $2 }')
-	printf "instance-id: iid-local01\n" > ${here}/media/nuageinit/meta-data
-	cat > media/nuageinit/user-data <<EOF
+	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
+	cat > media/nuageinit/user-data << EOF
 #cloud-config
-#
 network:
   version: 2
   ethernets:
     # opaque ID for physical interfaces, only referred to by other stanzas
     id0:
       match:
-        macaddress: '${myaddr}'
+        macaddress: "$myaddr"
       addresses:
-        - 192.168.14.2/24
-        - 2001:1::1/64
-      gateway4: 192.168.14.1
-      gateway6: 2001:1::2
+        - 192.0.2.2/24
+        - 2001:db8::2/64
+      gateway4: 192.0.2.1
+      gateway6: 2001:db8::1
 EOF
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit nocloud
-	cat > network <<EOF
-ifconfig_${myiface}="inet 192.168.14.2/24"
-ifconfig_${myiface}_ipv6="inet6 2001:1::1/64"
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
+	cat > network << EOF
+ifconfig_${myiface}="inet 192.0.2.2/24"
+ifconfig_${myiface}_ipv6="inet6 2001:db8::2/64"
 ipv6_network_interfaces="${myiface}"
 ipv6_default_interface="${myiface}"
 EOF
-	cat > routing <<EOF
-defaultrouter="192.168.14.1"
-ipv6_defaultrouter="2001:1::2"
-ipv6_route_${myiface}="2001:1::2 -prefixlen 128 -interface ${myiface}"
+	cat > routing << EOF
+defaultrouter="192.0.2.1"
+ipv6_defaultrouter="2001:db8::1"
+ipv6_route_${myiface}="2001:db8::1 -prefixlen 128 -interface ${myiface}"
 EOF
-	atf_check -o file:network cat ${here}/etc/rc.conf.d/network
-	atf_check -o file:routing cat ${here}/etc/rc.conf.d/routing
+	atf_check -o file:network cat "${PWD}"/etc/rc.conf.d/network
+	atf_check -o file:routing cat "${PWD}"/etc/rc.conf.d/routing
 }
+
 config2_body()
 {
-	here=$(pwd)
 	mkdir -p media/nuageinit
-	atf_check -s exit:1 -e match:"nuageinit: error parsing config-2: meta_data.json.*" /usr/libexec/nuageinit ${here}/media/nuageinit config-2
+	atf_check -s exit:1 -e match:"nuageinit: error parsing config-2 meta_data.json:.*" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	printf "{}" > media/nuageinit/meta_data.json
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit config-2
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	cat > media/nuageinit/meta_data.json << EOF
 {
-   "hostname": "cloudimg",
+    "hostname": "cloudimg"
 }
 EOF
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit config-2
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	atf_check -o inline:"hostname=\"cloudimg\"\n" cat etc/rc.conf.d/hostname
 }
 
+config2_pubkeys_head()
+{
+	atf_set "require.user" root
+}
 config2_pubkeys_body()
 {
-	here=$(pwd)
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	if [ $(id -u) -ne 0 ]; then
-		atf_skip "root required"
-	fi
 	mkdir -p media/nuageinit
 	touch media/nuageinit/meta_data.json
 	cat > media/nuageinit/user-data << EOF
 #cloud-config
-
 ssh_authorized_keys:
   - "ssh-rsa AAAAB3NzaC1y...== Generated by Nova"
 EOF
 	mkdir -p etc
-	cat > etc/master.passwd <<EOF
-root:*:0:0::0:0:Charlie &:/root:/bin/csh
-sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
+	cat > etc/master.passwd << EOF
+root:*:0:0::0:0:Charlie &:/root:/bin/sh
+sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
-	pwd_mkdb -d etc ${here}/etc/master.passwd
-	cat > etc/group <<EOF
+	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
+	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit config-2
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	atf_check -o inline:"ssh-rsa AAAAB3NzaC1y...== Generated by Nova\n" cat home/freebsd/.ssh/authorized_keys
 }
 
-
+config2_pubkeys_user_data_head()
+{
+	atf_set "require.user" root
+}
 config2_pubkeys_user_data_body()
 {
-	here=$(pwd)
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	if [ $(id -u) -ne 0 ]; then
-		atf_skip "root required"
-	fi
 	mkdir -p media/nuageinit
 	touch media/nuageinit/meta_data.json
 	cat > media/nuageinit/user_data << EOF
 #cloud-config
-
 ssh_authorized_keys:
   - "ssh-rsa AAAAB3NzaC1y...== Generated by Nova"
 EOF
 	mkdir -p etc
-	cat > etc/master.passwd <<EOF
-root:*:0:0::0:0:Charlie &:/root:/bin/csh
-sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
+	cat > etc/master.passwd << EOF
+root:*:0:0::0:0:Charlie &:/root:/bin/sh
+sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
-	pwd_mkdb -d etc ${here}/etc/master.passwd
-	cat > etc/group <<EOF
+	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
+	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit config-2
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	atf_check -o inline:"ssh-rsa AAAAB3NzaC1y...== Generated by Nova\n" cat home/freebsd/.ssh/authorized_keys
 }
 
@@ -251,37 +244,37 @@ config2_pubkeys_meta_data_body()
 		atf_skip "root required"
 	fi
 	mkdir -p media/nuageinit
-	cat > media/nuageinit/meta_data.json <<EOF
+	cat > media/nuageinit/meta_data.json << EOF
 {
-	"uuid": "uuid_for_this_instance",
-	"admin_pass": "a_generated_password",
-	"public_keys": {
-		"tdb": "ssh-ed25519 my_key_id tdb@host"
-	},
-	"keys": [
-	{
-		"name": "tdb",
-		"type": "ssh",
-		"data": "ssh-ed25519 my_key_id tdb@host"
-	}
-	],
-	"hostname": "freebsd-14-test.novalocal",
-	"name": "freebsd-14-test",
-	"launch_index": 0,
-	"availability_zone": "nova",
-	"random_seed": "long_random_seed",
-	"project_id": "my_project_id",
-	"devices": [],
-	"dedicated_cpus": []
+    "uuid": "uuid_for_this_instance",
+    "admin_pass": "a_generated_password",
+    "public_keys": {
+        "tdb": "ssh-ed25519 my_key_id tdb@host"
+    },
+    "keys": [
+        {
+            "name": "tdb",
+            "type": "ssh",
+            "data": "ssh-ed25519 my_key_id tdb@host"
+        }
+    ],
+    "hostname": "freebsd-14-test.novalocal",
+    "name": "freebsd-14-test",
+    "launch_index": 0,
+    "availability_zone": "nova",
+    "random_seed": "long_random_seed",
+    "project_id": "my_project_id",
+    "devices": [],
+    "dedicated_cpus": []
 }
 EOF
 	mkdir -p etc
-	cat > etc/master.passwd <<EOF
+	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/csh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
 EOF
 	pwd_mkdb -d etc ${here}/etc/master.passwd
-	cat > etc/group <<EOF
+	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
@@ -289,8 +282,8 @@ EOF
 	atf_check -o inline:"ssh-ed25519 my_key_id tdb@host\n" cat home/freebsd/.ssh/authorized_keys
 }
 
-config2_network_body() {
-	here=$(pwd)
+config2_network_body()
+{
 	mkdir -p media/nuageinit
 	printf "{}" > media/nuageinit/meta_data.json
 	mynetworks=$(ifconfig -l ether)
@@ -300,13 +293,13 @@ config2_network_body() {
 	set -- $mynetworks
 	myiface=$1
 	myaddr=$(ifconfig $myiface ether | awk '/ether/ { print $2 }')
-cat > media/nuageinit/network_data.json <<EOF
+cat > media/nuageinit/network_data.json << EOF
 {
     "links": [
         {
             "ethernet_mac_address": "$myaddr",
             "id": "iface0",
-            "mtu": null,
+            "mtu": null
         }
     ],
     "networks": [
@@ -315,49 +308,48 @@ cat > media/nuageinit/network_data.json <<EOF
             "link": "iface0",
             "type": "ipv4_dhcp"
         },
-	{ // IPv6
-	"id": "private-ipv4",
-	"type": "ipv6",
-	"link": "iface0",
-	// supports condensed IPv6 with CIDR netmask
-	"ip_address": "2001:cdba::3257:9652/24",
-	"gateway": "fd00::1"
-	"routes": [
-	    {
-		"network": "::",
-		"netmask": "::",
-		"gateway": "fd00::1"
-	},
-	    {
-		"network": "::",
-		"netmask": "ffff:ffff:ffff::",
-		"gateway": "fd00::1:1"
-	},
-	],
-	"network_id": "da5bb487-5193-4a65-a3df-4a0055a8c0d8"
-},
-    ],
+        { // IPv6
+            "id": "private-ipv4",
+            "type": "ipv6",
+            "link": "iface0",
+            // supports condensed IPv6 with CIDR netmask
+            "ip_address": "2001:db8::3257:9652/64",
+            "gateway": "fd00::1",
+            "routes": [
+                {
+                    "network": "::",
+                    "netmask": "::",
+                    "gateway": "fd00::1"
+                },
+                {
+                    "network": "::",
+                    "netmask": "ffff:ffff:ffff::",
+                    "gateway": "fd00::1:1"
+                }
+            ],
+            "network_id": "da5bb487-5193-4a65-a3df-4a0055a8c0d8"
+        }
+    ]
 }
 EOF
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit config-2
-	cat > network <<EOF
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
+	cat > network << EOF
 ifconfig_${myiface}="DHCP"
-ifconfig_${myiface}_ipv6="inet6 2001:cdba::3257:9652/24"
+ifconfig_${myiface}_ipv6="inet6 2001:db8::3257:9652/64"
 ipv6_network_interfaces="${myiface}"
 ipv6_default_interface="${myiface}"
 EOF
-	cat > routing <<EOF
+	cat > routing << EOF
 ipv6_defaultrouter="fd00::1"
 ipv6_route_${myiface}="fd00::1 -prefixlen 128 -interface ${myiface}"
 ipv6_static_routes="${myiface}"
 EOF
-	atf_check -o file:network cat ${here}/etc/rc.conf.d/network
-	atf_check -o file:routing cat ${here}/etc/rc.conf.d/routing
+	atf_check -o file:network cat "${PWD}"/etc/rc.conf.d/network
+	atf_check -o file:routing cat "${PWD}"/etc/rc.conf.d/routing
 }
 
-config2_network_static_v4_body() {
-	here=$(pwd)
+config2_network_static_v4_body()
+{
 	mkdir -p media/nuageinit
 	printf "{}" > media/nuageinit/meta_data.json
 	mynetworks=$(ifconfig -l ether)
@@ -367,51 +359,49 @@ config2_network_static_v4_body() {
 	set -- $mynetworks
 	myiface=$1
 	myaddr=$(ifconfig $myiface ether | awk '/ether/ { print $2 }')
-cat > media/nuageinit/network_data.json <<EOF
+cat > media/nuageinit/network_data.json << EOF
 {
     "links": [
         {
             "ethernet_mac_address": "$myaddr",
             "id": "iface0",
-            "mtu": null,
+            "mtu": null
         }
     ],
     "networks": [
         {
             "id": "network0",
             "link": "iface0",
-            "type": "ipv4"
+            "type": "ipv4",
             "ip_address": "10.184.0.244",
             "netmask": "255.255.240.0",
             "routes": [
-            {
-                "network": "10.0.0.0",
-                "netmask": "255.0.0.0",
-                "gateway": "11.0.0.1"
-            },
-            {
-                "network": "0.0.0.0",
-                "netmask": "0.0.0.0",
-                "gateway": "23.253.157.1"
-            }
-         ]
-     }
-]
+                {
+                    "network": "10.0.0.0",
+                    "netmask": "255.0.0.0",
+                    "gateway": "11.0.0.1"
+                },
+                {
+                    "network": "0.0.0.0",
+                    "netmask": "0.0.0.0",
+                    "gateway": "23.253.157.1"
+                }
+            ]
+        }
+    ]
 }
 EOF
-
-	export NUAGE_FAKE_ROOTDIR=$(pwd)
-	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit config-2
-	cat > network <<EOF
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
+	cat > network << EOF
 ifconfig_${myiface}="inet 10.184.0.244 netmask 255.255.240.0"
 EOF
-	cat > routing <<EOF
+	cat > routing << EOF
 route_cloudinit1_${myiface}="-net 10.0.0.0 11.0.0.1 255.0.0.0"
 defaultrouter="23.253.157.1"
 static_routes="cloudinit1_${myiface}"
 EOF
-	atf_check -o file:network cat ${here}/etc/rc.conf.d/network
-	atf_check -o file:routing cat ${here}/etc/rc.conf.d/routing
+	atf_check -o file:network cat "${PWD}"/etc/rc.conf.d/network
+	atf_check -o file:routing cat "${PWD}"/etc/rc.conf.d/routing
 }
 
 atf_init_test_cases()
diff --git a/libexec/nuageinit/tests/sethostname.lua b/libexec/nuageinit/tests/sethostname.lua
index 01434403934b..47632497b545 100644
--- a/libexec/nuageinit/tests/sethostname.lua
+++ b/libexec/nuageinit/tests/sethostname.lua
@@ -1,4 +1,5 @@
 #!/usr/libexec/flua
 
 local n = require("nuage")
+
 n.sethostname("myhostname")
diff --git a/libexec/nuageinit/tests/utils.sh b/libexec/nuageinit/tests/utils.sh
index 192ccfb565cb..26f117d81d60 100644
--- a/libexec/nuageinit/tests/utils.sh
+++ b/libexec/nuageinit/tests/utils.sh
@@ -1,20 +1,30 @@
+#-
+# Copyright (c) 2022 Baptiste Daroussin <bapt@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
 atf_test_case warn
 atf_test_case err
 atf_test_case dirname
 
-warn_body() {
-	atf_check -e "inline:plop\n" -s exit:0 /usr/libexec/flua $(atf_get_srcdir)/warn.lua
+warn_body()
+{
+	atf_check -e "inline:nuageinit: plop\n" -s exit:0 /usr/libexec/flua $(atf_get_srcdir)/warn.lua
 }
 
-err_body() {
-	atf_check -e "inline:plop\n" -s exit:1 /usr/libexec/flua $(atf_get_srcdir)/err.lua
+err_body()
+{
+	atf_check -e "inline:nuageinit: plop\n" -s exit:1 /usr/libexec/flua $(atf_get_srcdir)/err.lua
 }
 
-dirname_body() {
+dirname_body()
+{
 	atf_check -o "inline:/my/path/\n" -s exit:0 /usr/libexec/flua $(atf_get_srcdir)/dirname.lua
 }
 
-atf_init_test_cases() {
+atf_init_test_cases()
+{
 	atf_add_test_case warn
 	atf_add_test_case err
 	atf_add_test_case dirname
diff --git a/libexec/nuageinit/tests/warn.lua b/libexec/nuageinit/tests/warn.lua
index 8575ae92c071..ce2b63a8dbf0 100644
--- a/libexec/nuageinit/tests/warn.lua
+++ b/libexec/nuageinit/tests/warn.lua
@@ -1,4 +1,5 @@
 #!/usr/libexec/flua
 
 local n = require("nuage")
+
 n.warn("plop")
diff --git a/libexec/nuageinit/yaml.lua b/libexec/nuageinit/yaml.lua
index 8ab17b15eed7..2cd50c29a469 100644
--- a/libexec/nuageinit/yaml.lua
+++ b/libexec/nuageinit/yaml.lua
@@ -1,3 +1,4 @@
+---
 -- SPDX-License-Identifier: MIT
 --
 -- Copyright (c) 2017 Dominic Letz dominicletz@exosite.com
diff --git a/libexec/rc/rc.d/nuageinit b/libexec/rc/rc.d/nuageinit
index 8da0b1aed741..a44761ea1d9e 100755
--- a/libexec/rc/rc.d/nuageinit
+++ b/libexec/rc/rc.d/nuageinit
@@ -18,8 +18,8 @@ nuageinit_start()
 {
 	local citype
 	# detect cloud init provider
-	# according to the specification of the config drive
-	# it either formatted in vfat or iso9660 and labeled
+	# according to the specification, the config drive
+	# is either formatted in vfat or iso9660 and labeled
 	# config-2
 	for f in iso9660 msdosfs; do
 		drive="/dev/$f/[cC][oO][nN][fF][iI][gG]-2"
@@ -39,7 +39,7 @@ nuageinit_start()
 		err 1 "Impossible to find a cloud init provider"
 	fi
 	mkdir -p /media/nuageinit
-	fs=$(fstyp $drive)
+	fs=$(fstyp $drive 2> /dev/null)
 	mount -t $fs $drive /media/nuageinit
 	# according to the specification, the content is either
 	# in the openstack or ec2 directory
diff --git a/release/tools/basic-cloudinit.conf b/release/tools/basic-cloudinit.conf
index da4bed5ea5b5..a03c11603ed6 100644
--- a/release/tools/basic-cloudinit.conf
+++ b/release/tools/basic-cloudinit.conf
@@ -1,6 +1,4 @@
 #!/bin/sh
-#
-#
 
 # Should be enough for base image, image can be resized in needed
 export VMSIZE=5g
@@ -9,13 +7,17 @@ export VMSIZE=5g
 export CONFIG_DRIVE=YES
 export CONFIG_DRIVE_SIZE=1M
 
+# Packages to install into the image we're creating.
+# * firstboot-freebsd-update, to install security updates at first boot.
+export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} firstboot-freebsd-update"
+
 # Set to a list of third-party software to enable in rc.conf(5).
-export VM_RC_LIST="sshd growfs nuageinit"
+export VM_RC_LIST="${VM_RC_LIST} firstboot_freebsd_update growfs sshd nuageinit"
 
 vm_extra_pre_umount() {
 	cat << EOF >> ${DESTDIR}/etc/rc.conf
 dumpdev="AUTO"
-ifconfig_DEFAULT="DHCP"
+ifconfig_DEFAULT="SYNCDHCP accept_rtadv"
 sshd_enable="YES"
 EOF
 
@@ -25,7 +27,8 @@ beastie_disable="YES"
 loader_logo="none"
 console="comconsole,vidconsole"
 EOF
-    cat <<EOF >> ${DESTDIR}/etc/ssh/sshd_config
+
+	cat << EOF >> ${DESTDIR}/etc/ssh/sshd_config
 PasswordAuthentication yes
 UsePAM no
 EOF
diff --git a/sys/dev/gpio/gpioc.c b/sys/dev/gpio/gpioc.c
index 4ebf958d6974..b9d95338e211 100644
--- a/sys/dev/gpio/gpioc.c
+++ b/sys/dev/gpio/gpioc.c
@@ -677,19 +677,18 @@ static int
 gpioc_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
 {
 	struct gpioc_cdevpriv *priv;
-	int err;
+	int err = 0;
 
 	priv = malloc(sizeof(*priv), M_GPIOC, M_WAITOK | M_ZERO);
 	priv->sc = dev->si_drv1;
-	priv->report_option = GPIO_EVENT_REPORT_DETAIL;
-	err = devfs_set_cdevpriv(priv, gpioc_cdevpriv_dtor);
-	if (err != 0) {
-		gpioc_cdevpriv_dtor(priv);
-		return (err);
-	}
+
 	mtx_init(&priv->mtx, "gpioc priv", NULL, MTX_DEF);
 	knlist_init_mtx(&priv->selinfo.si_note, &priv->mtx);
 
+	priv->async = false;
+	priv->report_option = GPIO_EVENT_REPORT_DETAIL;
+	priv->sigio = NULL;
+
 	/*
 	 * Allocate a circular buffer for events.  The scheme we use for summary
 	 * reporting assumes there will always be a pair of events available to
@@ -701,7 +700,13 @@ gpioc_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
 	priv->events = malloc(priv->numevents * sizeof(struct gpio_event_detail),
 	    M_GPIOC, M_WAITOK | M_ZERO);
 
-	return (0);
+	priv->evidx_head = priv->evidx_tail = 0;
+	SLIST_INIT(&priv->pins);
+
+	err = devfs_set_cdevpriv(priv, gpioc_cdevpriv_dtor);
+	if (err != 0)
+		gpioc_cdevpriv_dtor(priv);
+	return (err);
 }
 
 static int
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index e83422e3a29f..189e8ca5b498 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -153,6 +153,7 @@
 #include <net/vnet.h>
 
 #include <security/mac/mac_framework.h>
+#include <security/mac/mac_internal.h>
 
 #include <vm/uma.h>
 
@@ -1485,6 +1486,10 @@ solisten_proto(struct socket *so, int backlog)
 	sbrcv_timeo = so->so_rcv.sb_timeo;
 	sbsnd_timeo = so->so_snd.sb_timeo;
 
+#ifdef MAC
+	mac_socketpeer_label_free(so->so_peerlabel);
+#endif
+
 	if (!(so->so_proto->pr_flags & PR_SOCKBUF)) {
 		sbdestroy(so, SO_SND);
 		sbdestroy(so, SO_RCV);
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
index 80bf12474c1c..ed131421207d 100644
--- a/sys/netinet/tcp_syncache.c
+++ b/sys/netinet/tcp_syncache.c
@@ -1372,7 +1372,7 @@ syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 	int autoflowlabel = 0;
 #endif
 #ifdef MAC
-	struct label *maclabel;
+	struct label *maclabel = NULL;
 #endif
 	struct syncache scs;
 	struct ucred *cred;
@@ -1763,10 +1763,11 @@ donenoprobe:
 tfo_expanded:
 	if (cred != NULL)
 		crfree(cred);
+	if (sc == NULL || sc == &scs) {
 #ifdef MAC
-	if (sc == &scs)
 		mac_syncache_destroy(&maclabel);
 #endif
+	}
 	return (rv);
 }
 
diff --git a/sys/security/mac/mac_inet.c b/sys/security/mac/mac_inet.c
index 29a355071065..9770fa840f95 100644
--- a/sys/security/mac/mac_inet.c
+++ b/sys/security/mac/mac_inet.c
@@ -485,6 +485,7 @@ mac_syncache_init(struct label **label)
 			MAC_POLICY_PERFORM_NOSLEEP(syncache_destroy_label,
 			    *label);
 			mac_labelzone_free(*label);
+			*label = NULL;
 		}
 		return (error);
 	} else
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index aa407598600a..89f74a65c803 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -242,6 +242,7 @@ struct label	*mac_pipe_label_alloc(void);
 void		 mac_pipe_label_free(struct label *label);
 struct label	*mac_socket_label_alloc(int flag);
 void		 mac_socket_label_free(struct label *label);
+void		 mac_socketpeer_label_free(struct label *label);
 struct label	*mac_vnode_label_alloc(void);
 void		 mac_vnode_label_free(struct label *label);
 
diff --git a/sys/security/mac/mac_socket.c b/sys/security/mac/mac_socket.c
index e9f94404734a..b03f98bbfdb5 100644
--- a/sys/security/mac/mac_socket.c
+++ b/sys/security/mac/mac_socket.c
@@ -170,7 +170,7 @@ mac_socket_label_free(struct label *label)
 	mac_labelzone_free(label);
 }
 
-static void
+void
 mac_socketpeer_label_free(struct label *label)
 {
 
@@ -185,8 +185,10 @@ mac_socket_destroy(struct socket *so)
 	if (so->so_label != NULL) {
 		mac_socket_label_free(so->so_label);
 		so->so_label = NULL;
-		mac_socketpeer_label_free(so->so_peerlabel);
-		so->so_peerlabel = NULL;
+		if (!SOLISTENING(so)) {
+			mac_socketpeer_label_free(so->so_peerlabel);
+			so->so_peerlabel = NULL;
+		}
 	}
 }
 
@@ -618,10 +620,15 @@ mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so,
 	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
 	intlabel = mac_socket_label_alloc(M_WAITOK);
 	SOCK_LOCK(so);
-	mac_socket_copy_label(so->so_peerlabel, intlabel);
+	if (SOLISTENING(so))
+		error = EINVAL;
+	else
+		mac_socket_copy_label(so->so_peerlabel, intlabel);
 	SOCK_UNLOCK(so);
-	error = mac_socketpeer_externalize_label(intlabel, elements, buffer,
-	    mac->m_buflen);
+	if (error == 0) {
+		error = mac_socketpeer_externalize_label(intlabel, elements, buffer,
+		    mac->m_buflen);
+	}
 	mac_socket_label_free(intlabel);
 	if (error == 0)
 		error = copyout(buffer, mac->m_string, strlen(buffer)+1);