From ee9ff77fc82b523eed8b894bd1d0a331cacfc5db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20=27sil2100=27=20Zemczak?=
 <lukasz.zemczak@chainguard.dev>
Date: Wed, 17 Sep 2025 15:20:59 -0500
Subject: [PATCH 1/2] Add check-restored-packages pre-commit hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Łukasz 'sil2100' Zemczak <lukasz.zemczak@chainguard.dev>
---
 .pre-commit-hooks.yaml             |  9 ++++++++
 scripts/check-restored-packages.sh | 37 ++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)
 create mode 100755 scripts/check-restored-packages.sh

diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml
index c78a274..1d0a6a1 100644
--- a/.pre-commit-hooks.yaml
+++ b/.pre-commit-hooks.yaml
@@ -20,3 +20,12 @@
     - manual
   types:
     - yaml
+- id: check-restored-packages
+  name: Check restored packages against withdrawn
+  description: Ensures packages being added to restored-packages.txt are removed from withdrawn-packages.txt first
+  entry: scripts/check-restored-packages.sh
+  language: script
+  stages:
+    - pre-commit
+    - manual
+  files: ^restored-packages\.txt$
diff --git a/scripts/check-restored-packages.sh b/scripts/check-restored-packages.sh
new file mode 100755
index 0000000..6b8b2f4
--- /dev/null
+++ b/scripts/check-restored-packages.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e
+
+# Check if restored-packages.txt is being modified
+if ! git diff --cached --name-only | grep -q "restored-packages.txt"; then
+    exit 0
+fi
+
+if [ ! -f "withdrawn-packages.txt" ] || [ ! -f "restored-packages.txt" ]; then
+    exit 0
+fi
+
+# Get the new lines being added to restored-packages.txt
+NEW_PACKAGES=$(git diff --cached "restored-packages.txt" | grep "^+" | grep -v "^+++" | sed 's/^+//' | grep -v '^$' | grep -v '^#')
+
+if [ -z "$NEW_PACKAGES" ]; then
+    exit 0
+fi
+
+# Check if any new packages are in withdrawn-packages.txt
+CONFLICTS=""
+while IFS= read -r package; do
+    if [ -n "$package" ]; then
+        if grep -Fxq "$package" "withdrawn-packages.txt"; then
+            CONFLICTS="${CONFLICTS}${package}\n"
+        fi
+    fi
+done <<< "$NEW_PACKAGES"
+
+if [ -n "$CONFLICTS" ]; then
+    echo "ERROR: The following packages are being added to restored-packages.txt but are still present in withdrawn-packages.txt:"
+    echo -e "$CONFLICTS"
+    echo "Please remove these packages from withdrawn-packages.txt first, then commit again."
+    exit 1
+fi
+
+exit 0

From ee6861d55d324936a39976ff123c1cc7ce1cfb11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20=27sil2100=27=20Zemczak?=
 <lukasz.zemczak@chainguard.dev>
Date: Wed, 17 Sep 2025 16:10:15 -0500
Subject: [PATCH 2/2] Move the file-existence checks as first.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Łukasz 'sil2100' Zemczak <lukasz.zemczak@chainguard.dev>
---
 scripts/check-restored-packages.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/check-restored-packages.sh b/scripts/check-restored-packages.sh
index 6b8b2f4..89ef494 100755
--- a/scripts/check-restored-packages.sh
+++ b/scripts/check-restored-packages.sh
@@ -1,12 +1,12 @@
 #!/bin/bash
 set -e
 
-# Check if restored-packages.txt is being modified
-if ! git diff --cached --name-only | grep -q "restored-packages.txt"; then
+if [ ! -f "withdrawn-packages.txt" ] || [ ! -f "restored-packages.txt" ]; then
     exit 0
 fi
 
-if [ ! -f "withdrawn-packages.txt" ] || [ ! -f "restored-packages.txt" ]; then
+# Check if restored-packages.txt is being modified
+if ! git diff --cached --name-only | grep -q "restored-packages.txt"; then
     exit 0
 fi