[python] Fix Sigstore verification for Python 3.14+

.github/workflows/test-pr.yaml

@@ -41,6 +41,16 @@ jobs:
             terraform: ./**/terraform/**
             nix: ./**/nix/**
 
+  python-sigstore:
+    needs: [detect-changes]
+    if: contains(fromJSON(needs.detect-changes.outputs.features), 'python')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: "Test Python Sigstore verification"
+        run: bash test/python/sigstore_verification_test.sh
+
   test:
     needs: [detect-changes]
     runs-on: ubuntu-latest

src/python/NOTES.md

@@ -9,3 +9,7 @@ This Feature should work on recent versions of Debian/Ubuntu, RedHat Enterprise
 ## Additional Python versions
 
 `additionalVersions` accepts a comma-separated list. Comma splitting is scoped to reading this list so package-manager commands keep normal shell word splitting during each installation.
+
+## Source Verification
+
+The feature verifies the authenticity and integrity of downloaded Python source archives. Python 3.14 and later use Sigstore (via Cosign) instead of GPG. For Python 3.14 and later, verification follows a fail-open policy: unsuccessful or unavailable verification is reported as a warning and does not block installation.

src/python/devcontainer-feature.json

@@ -1,6 +1,6 @@
 {
   "id": "python",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "name": "Python",
   "documentationURL": "https://github.com/devcontainers/features/tree/main/src/python",
   "description": "Installs the provided version of Python, as well as PIPX, and other common Python utilities.  JupyterLab is conditionally installed with the python feature. Note: May require source code compilation.",