From 9da98a7880109a599b01e5f2b9fd11757ff96f1e Mon Sep 17 00:00:00 2001
From: yabobay <yabobay@yahoo.com>
Date: Fri, 19 Jun 2026 22:25:33 +0300
Subject: [PATCH] Packages (Linux): support porg

---
 src/detection/packages/packages.h       | 1 +
 src/detection/packages/packages_linux.c | 3 +++
 src/modules/packages/option.h           | 1 +
 src/modules/packages/packages.c         | 6 ++++++
 4 files changed, 11 insertions(+)

diff --git a/src/detection/packages/packages.h b/src/detection/packages/packages.h
index f0d42004de..a29e7dba90 100644
--- a/src/detection/packages/packages.h
+++ b/src/detection/packages/packages.h
@@ -40,6 +40,7 @@ typedef struct FFPackagesResult {
     uint32_t pkg;
     uint32_t pkgsrc;
     uint32_t pkgtool;
+    uint32_t porg;
     uint32_t rpm;
     uint32_t scoopGlobal;
     uint32_t scoopUser;
diff --git a/src/detection/packages/packages_linux.c b/src/detection/packages/packages_linux.c
index 79de8cb3e3..3bb5c6ea87 100644
--- a/src/detection/packages/packages_linux.c
+++ b/src/detection/packages/packages_linux.c
@@ -493,6 +493,9 @@ static void getPackageCounts(FFstrbuf* baseDir, FFPackagesResult* packageCounts,
     if (FF_PACKAGES_IS_ENABLED(options, PKGTOOL)) {
         packageCounts->pkgtool += getNumElements(baseDir, "/var/log/packages", false);
     }
+    if (FF_PACKAGES_IS_ENABLED(options, PORG)) {
+        packageCounts->porg += getNumElements(baseDir, "/var/log/porg", false);
+    }
     if (FF_PACKAGES_IS_ENABLED(options, RPM)) {
         // `Sigmd5` is the only table that doesn't contain the virtual `gpg-pubkey` package
         packageCounts->rpm += getSQLite3Int(baseDir, "/var/lib/rpm/rpmdb.sqlite", "SELECT count(*) FROM Sigmd5", "rpm");
diff --git a/src/modules/packages/option.h b/src/modules/packages/option.h
index 1e895335a3..75884f33c2 100644
--- a/src/modules/packages/option.h
+++ b/src/modules/packages/option.h
@@ -39,6 +39,7 @@ typedef enum FF_A_PACKED FFPackagesFlags {
     FF_PACKAGES_FLAG_MOSS_BIT = UINT64_C(1) << 32U,
     FF_PACKAGES_FLAG_APPIMAGE_BIT = UINT64_C(1) << 33U,
     FF_PACKAGES_FLAG_CARDS_BIT = UINT64_C(1) << 34U,
+    FF_PACKAGES_FLAG_PORG_BIT = UINT64_C(1) << 35U,
     FF_PACKAGES_FLAG_FORCE_UNSIGNED = UINT64_MAX,
 } FFPackagesFlags;
 static_assert(sizeof(FFPackagesFlags) == sizeof(uint64_t), "");
diff --git a/src/modules/packages/packages.c b/src/modules/packages/packages.c
index efcb84bdc9..ee8ecb8bfb 100644
--- a/src/modules/packages/packages.c
+++ b/src/modules/packages/packages.c
@@ -119,6 +119,7 @@ bool ffPrintPackages(FFPackagesOptions* options) {
         FF_PRINT_PACKAGE(pkg)
         FF_PRINT_PACKAGE(pkgsrc)
         FF_PRINT_PACKAGE(pkgtool)
+        FF_PRINT_PACKAGE(porg)
         FF_PRINT_PACKAGE(rpm)
         if (options->combined) {
             FF_PRINT_PACKAGE_ALL(scoop);
@@ -181,6 +182,7 @@ bool ffPrintPackages(FFPackagesOptions* options) {
                 FF_ARG(counts.pkg, "pkg"),
                 FF_ARG(counts.pkgsrc, "pkgsrc"),
                 FF_ARG(counts.pkgtool, "pkgtool"),
+                FF_ARG(counts.porg, "porg"),
                 FF_ARG(counts.rpm, "rpm"),
                 FF_ARG(counts.scoopGlobal, "scoop-global"),
                 FF_ARG(counts.scoopUser, "scoop-user"),
@@ -319,6 +321,7 @@ void ffParsePackagesJsonObject(FFPackagesOptions* options, yyjson_val* module) {
                             FF_TEST_PACKAGE_NAME(PKG)
                             FF_TEST_PACKAGE_NAME(PKGSRC)
                             FF_TEST_PACKAGE_NAME(PKGTOOL)
+                            FF_TEST_PACKAGE_NAME(PORG)
                             break;
                         case 'R':
                             if (false)
@@ -402,6 +405,7 @@ void ffGeneratePackagesJsonConfig(FFPackagesOptions* options, yyjson_mut_doc* do
     FF_TEST_PACKAGE_NAME(PKG)
     FF_TEST_PACKAGE_NAME(PKGSRC)
     FF_TEST_PACKAGE_NAME(PKGTOOL)
+    FF_TEST_PACKAGE_NAME(PORG)
     FF_TEST_PACKAGE_NAME(RPM)
     FF_TEST_PACKAGE_NAME(SCOOP)
     FF_TEST_PACKAGE_NAME(SNAP)
@@ -468,6 +472,7 @@ bool ffGeneratePackagesJsonResult(FFPackagesOptions* options, yyjson_mut_doc* do
     FF_APPEND_PACKAGE_COUNT(pkg)
     FF_APPEND_PACKAGE_COUNT(pkgsrc)
     FF_APPEND_PACKAGE_COUNT(pkgtool)
+    FF_APPEND_PACKAGE_COUNT(porg)
     FF_APPEND_PACKAGE_COUNT(rpm)
     FF_APPEND_PACKAGE_COUNT(scoopGlobal)
     FF_APPEND_PACKAGE_COUNT(scoopUser)
@@ -543,6 +548,7 @@ FFModuleBaseInfo ffPackagesModuleInfo = {
         { "Number of pkg packages", "pkg" },
         { "Number of pkgsrc packages", "pkgsrc" },
         { "Number of pkgtool packages", "pkgtool" },
+        { "Number of porg packages", "porg" },
         { "Number of rpm packages", "rpm" },
         { "Number of scoop-global packages", "scoop-global" },
         { "Number of scoop-user packages", "scoop-user" },