base-files, metadata: support additional group membership