From 3a2ae381f282183d20dec2cc8cfd47601cd49f7f Mon Sep 17 00:00:00 2001
From: Anthonios Partheniou <partheniou@google.com>
Date: Tue, 7 Oct 2025 19:31:40 +0000
Subject: [PATCH 1/5] feat: add Python 3.14 to samples testing image

---
 .kokoro/docker/Dockerfile         |  2 +-
 .kokoro/python3.14/common.cfg     | 59 +++++++++++++++++++++++++++++++
 .kokoro/python3.14/continuous.cfg | 21 +++++++++++
 .kokoro/python3.14/periodic.cfg   | 27 ++++++++++++++
 .kokoro/python3.14/presubmit.cfg  | 21 +++++++++++
 5 files changed, 129 insertions(+), 1 deletion(-)
 create mode 100644 .kokoro/python3.14/common.cfg
 create mode 100644 .kokoro/python3.14/continuous.cfg
 create mode 100644 .kokoro/python3.14/periodic.cfg
 create mode 100644 .kokoro/python3.14/presubmit.cfg

diff --git a/.kokoro/docker/Dockerfile b/.kokoro/docker/Dockerfile
index ba9af12a933..2e59a5b9b12 100644
--- a/.kokoro/docker/Dockerfile
+++ b/.kokoro/docker/Dockerfile
@@ -116,7 +116,7 @@ RUN set -ex \
   && export GNUPGHOME="$(mktemp -d)" \
   && echo "disable-ipv6" >> "${GNUPGHOME}/dirmngr.conf" \
   && /tmp/fetch_gpg_keys.sh \
-  && for PYTHON_VERSION in 2.7.18 3.7.17 3.8.20 3.9.20 3.10.15 3.11.10 3.12.7 3.13.0; do \
+  && for PYTHON_VERSION in 2.7.18 3.7.17 3.8.20 3.9.23 3.10.18 3.11.13 3.12.11 3.13.8 3.14.0; do \
   wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" \
   && wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" \
   && gpg --batch --verify python-${PYTHON_VERSION}.tar.xz.asc python-${PYTHON_VERSION}.tar.xz \
diff --git a/.kokoro/python3.14/common.cfg b/.kokoro/python3.14/common.cfg
new file mode 100644
index 00000000000..8d12e9ed952
--- /dev/null
+++ b/.kokoro/python3.14/common.cfg
@@ -0,0 +1,59 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Format: //devtools/kokoro/config/proto/build.proto
+
+timeout_mins: 300
+
+# Configure the docker image for kokoro-trampoline.
+env_vars: {
+    key: "TRAMPOLINE_IMAGE"
+    value: "gcr.io/cloud-devrel-kokoro-resources/python-samples-testing-docker"
+}
+
+# Download trampoline resources.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
+
+# Use the trampoline script to run in docker.
+build_file: "python-docs-samples/.kokoro/trampoline_v2.sh"
+
+# Download secrets from Cloud Storage.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/python-docs-samples"
+
+# Access btlr binaries used in the tests
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/btlr"
+
+# Copy results for Resultstore
+action {
+  define_artifacts {
+    regex: "**/*sponge_log.xml"
+  }
+}
+
+# Specify which tests to run
+env_vars: {
+    key: "RUN_TESTS_SESSION"
+    value: "py-3.14"
+}
+
+env_vars: {
+    key: "BUILD_SPECIFIC_GCLOUD_PROJECT"
+    value: "python-docs-samples-tests-314"
+}
+
+# Number of test workers.
+env_vars: {
+    key: "NUM_TEST_WORKERS"
+    value: "10"
+}
diff --git a/.kokoro/python3.14/continuous.cfg b/.kokoro/python3.14/continuous.cfg
new file mode 100644
index 00000000000..5753c38482a
--- /dev/null
+++ b/.kokoro/python3.14/continuous.cfg
@@ -0,0 +1,21 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Format: //devtools/kokoro/config/proto/build.proto
+
+# Tell the trampoline which build file to use.
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: ".kokoro/tests/run_tests_diff_head.sh"
+}
diff --git a/.kokoro/python3.14/periodic.cfg b/.kokoro/python3.14/periodic.cfg
new file mode 100644
index 00000000000..8a14abb05ef
--- /dev/null
+++ b/.kokoro/python3.14/periodic.cfg
@@ -0,0 +1,27 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Format: //devtools/kokoro/config/proto/build.proto
+
+# Tell the trampoline which build file to use.
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: ".kokoro/tests/run_tests.sh"
+}
+
+# Tell Trampoline to upload the Docker image after successfull build.
+env_vars: {
+    key: "TRAMPOLINE_IMAGE_UPLOAD"
+    value: "true"
+}
diff --git a/.kokoro/python3.14/presubmit.cfg b/.kokoro/python3.14/presubmit.cfg
new file mode 100644
index 00000000000..b8ecd3b0d15
--- /dev/null
+++ b/.kokoro/python3.14/presubmit.cfg
@@ -0,0 +1,21 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Format: //devtools/kokoro/config/proto/build.proto
+
+# Tell the trampoline which build file to use.
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: ".kokoro/tests/run_tests_diff_main.sh"
+}

From d92eb950585e3b78228836eda4afc15ded9b4473 Mon Sep 17 00:00:00 2001
From: Anthonios Partheniou <partheniou@google.com>
Date: Tue, 7 Oct 2025 19:37:45 +0000
Subject: [PATCH 2/5] address review feedback

---
 .kokoro/docker/Dockerfile | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.kokoro/docker/Dockerfile b/.kokoro/docker/Dockerfile
index 2e59a5b9b12..1663d4f126c 100644
--- a/.kokoro/docker/Dockerfile
+++ b/.kokoro/docker/Dockerfile
@@ -116,7 +116,17 @@ RUN set -ex \
   && export GNUPGHOME="$(mktemp -d)" \
   && echo "disable-ipv6" >> "${GNUPGHOME}/dirmngr.conf" \
   && /tmp/fetch_gpg_keys.sh \
-  && for PYTHON_VERSION in 2.7.18 3.7.17 3.8.20 3.9.23 3.10.18 3.11.13 3.12.11 3.13.8 3.14.0; do \
+  && PYTHON_VERSIONS="\
+  2.7.18 \
+  3.7.17 \
+  3.8.20 \
+  3.9.23 \
+  3.10.18 \
+  3.11.13 \
+  3.12.11 \
+  3.13.8 \
+  3.14.0" \
+&& for PYTHON_VERSION in $PYTHON_VERSIONS; do \
   wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" \
   && wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" \
   && gpg --batch --verify python-${PYTHON_VERSION}.tar.xz.asc python-${PYTHON_VERSION}.tar.xz \

From 54bacd7e3fe956be2e8a5deea2a2f068f30941d9 Mon Sep 17 00:00:00 2001
From: Anthonios Partheniou <partheniou@google.com>
Date: Tue, 7 Oct 2025 19:38:34 +0000
Subject: [PATCH 3/5] formatting

---
 .kokoro/docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.kokoro/docker/Dockerfile b/.kokoro/docker/Dockerfile
index 1663d4f126c..bff93e5732e 100644
--- a/.kokoro/docker/Dockerfile
+++ b/.kokoro/docker/Dockerfile
@@ -126,7 +126,7 @@ RUN set -ex \
   3.12.11 \
   3.13.8 \
   3.14.0" \
-&& for PYTHON_VERSION in $PYTHON_VERSIONS; do \
+  && for PYTHON_VERSION in $PYTHON_VERSIONS; do \
   wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" \
   && wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" \
   && gpg --batch --verify python-${PYTHON_VERSION}.tar.xz.asc python-${PYTHON_VERSION}.tar.xz \

From ce7eb3715792e2d503618c452096d109ac028e54 Mon Sep 17 00:00:00 2001
From: Anthonios Partheniou <partheniou@google.com>
Date: Tue, 7 Oct 2025 23:43:43 +0000
Subject: [PATCH 4/5] wip

---
 .kokoro/docker/Dockerfile | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.kokoro/docker/Dockerfile b/.kokoro/docker/Dockerfile
index bff93e5732e..77a7e267132 100644
--- a/.kokoro/docker/Dockerfile
+++ b/.kokoro/docker/Dockerfile
@@ -126,15 +126,15 @@ RUN set -ex \
   3.12.11 \
   3.13.8 \
   3.14.0" \
-  && for PYTHON_VERSION in $PYTHON_VERSIONS; do \
-  wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" \
-  && wget --no-check-certificate -O python-${PYTHON_VERSION}.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" \
-  && gpg --batch --verify python-${PYTHON_VERSION}.tar.xz.asc python-${PYTHON_VERSION}.tar.xz \
-  && rm -r python-${PYTHON_VERSION}.tar.xz.asc \
-  && mkdir -p /usr/src/python-${PYTHON_VERSION} \
-  && tar -xJC /usr/src/python-${PYTHON_VERSION} --strip-components=1 -f python-${PYTHON_VERSION}.tar.xz \
-  && rm python-${PYTHON_VERSION}.tar.xz \
-  && cd /usr/src/python-${PYTHON_VERSION} \
+  && for VERSION in $PYTHON_VERSIONS; do \
+  wget --no-check-certificate -O python-${VERSION}.tar.xz "https://www.python.org/ftp/python/${VERSION%%[a-z]*}/Python-$VERSION.tar.xz" \
+  && wget --no-check-certificate -O python-${VERSION}.tar.xz.asc "https://www.python.org/ftp/python/${VERSION%%[a-z]*}/Python-$VERSION.tar.xz.asc" \
+  && gpg --batch --verify python-${VERSION}.tar.xz.asc python-${VERSION}.tar.xz \
+  && rm -r python-${VERSION}.tar.xz.asc \
+  && mkdir -p /usr/src/python-${VERSION} \
+  && tar -xJC /usr/src/python-${VERSION} --strip-components=1 -f python-${VERSION}.tar.xz \
+  && rm python-${VERSION}.tar.xz \
+  && cd /usr/src/python-${VERSION} \
   && ./configure \
   --enable-shared \
   # This works only on Python 2.7 and throws a warning on every other

From f3c7054b1e868961ad25bcda519372d821736ddd Mon Sep 17 00:00:00 2001
From: Anthonios Partheniou <partheniou@google.com>
Date: Wed, 8 Oct 2025 02:13:49 +0000
Subject: [PATCH 5/5] remove gpg;add sigstore;remove python 2.7 which doesn't
 support sigstore

---
 .kokoro/docker/Dockerfile        | 99 ++++++++++++++++++++------------
 .kokoro/docker/fetch_gpg_keys.sh | 57 ------------------
 2 files changed, 63 insertions(+), 93 deletions(-)
 delete mode 100755 .kokoro/docker/fetch_gpg_keys.sh

diff --git a/.kokoro/docker/Dockerfile b/.kokoro/docker/Dockerfile
index 77a7e267132..c37e7f091e2 100644
--- a/.kokoro/docker/Dockerfile
+++ b/.kokoro/docker/Dockerfile
@@ -110,43 +110,68 @@ RUN curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add - \
   && rm -rf /var/lib/apt/lists/* \
   && rm -f /var/cache/apt/archives/*.deb
 
-COPY fetch_gpg_keys.sh /tmp
-# Install the desired versions of Python.
-RUN set -ex \
-  && export GNUPGHOME="$(mktemp -d)" \
-  && echo "disable-ipv6" >> "${GNUPGHOME}/dirmngr.conf" \
-  && /tmp/fetch_gpg_keys.sh \
-  && PYTHON_VERSIONS="\
-  2.7.18 \
-  3.7.17 \
-  3.8.20 \
-  3.9.23 \
-  3.10.18 \
-  3.11.13 \
-  3.12.11 \
-  3.13.8 \
-  3.14.0" \
-  && for VERSION in $PYTHON_VERSIONS; do \
-  wget --no-check-certificate -O python-${VERSION}.tar.xz "https://www.python.org/ftp/python/${VERSION%%[a-z]*}/Python-$VERSION.tar.xz" \
-  && wget --no-check-certificate -O python-${VERSION}.tar.xz.asc "https://www.python.org/ftp/python/${VERSION%%[a-z]*}/Python-$VERSION.tar.xz.asc" \
-  && gpg --batch --verify python-${VERSION}.tar.xz.asc python-${VERSION}.tar.xz \
-  && rm -r python-${VERSION}.tar.xz.asc \
-  && mkdir -p /usr/src/python-${VERSION} \
-  && tar -xJC /usr/src/python-${VERSION} --strip-components=1 -f python-${VERSION}.tar.xz \
-  && rm python-${VERSION}.tar.xz \
-  && cd /usr/src/python-${VERSION} \
-  && ./configure \
-  --enable-shared \
-  # This works only on Python 2.7 and throws a warning on every other
-  # version, but seems otherwise harmless.
-  --enable-unicode=ucs4 \
-  --with-system-ffi \
-  --without-ensurepip \
-  && make -j$(nproc) \
-  && make install \
-  && ldconfig \
+# From https://www.python.org/downloads/metadata/sigstore/
+# Starting with Python 3.14, Sigstore is the only method of signing and verification of release artifacts. 
+RUN LATEST_VERSION="2.6.1" && \
+    wget "https://github.com/sigstore/cosign/releases/download/v${LATEST_VERSION}/cosign_${LATEST_VERSION}_amd64.deb" && \
+    dpkg -i cosign_${LATEST_VERSION}_amd64.deb && \
+    rm cosign_${LATEST_VERSION}_amd64.deb
+
+ARG PYTHON_VERSIONS="3.7.17 3.8.20 3.9.23 3.10.18 3.11.13 3.12.11 3.13.8 3.14.0"
+
+SHELL ["/bin/bash", "-c"]
+
+RUN set -eux; \
+    # Define the required associative arrays completely.
+    declare -A PYTHON_IDENTITIES; \
+    PYTHON_IDENTITIES=(\
+        [3.7]="nad@python.org" \
+        [3.8]="lukasz@langa.pl" \
+        [3.9]="lukasz@langa.pl" \
+        [3.10]="pablogsal@python.org" \
+        [3.11]="pablogsal@python.org" \
+        [3.12]="thomas@python.org" \
+        [3.13]="thomas@python.org" \
+        [3.14]="hugo@python.org" \
+    ); \
+    declare -A PYTHON_ISSUERS; \
+    PYTHON_ISSUERS=(\
+        [3.7]="https://github.com/login/oauth" \
+        [3.8]="https://github.com/login/oauth" \
+        [3.9]="https://github.com/login/oauth" \
+        [3.10]="https://accounts.google.com" \
+        [3.11]="https://accounts.google.com" \
+        [3.12]="https://accounts.google.com" \
+        [3.13]="https://accounts.google.com" \
+        [3.14]="https://github.com/login/oauth" \
+    ); \
+    \
+    for VERSION in $PYTHON_VERSIONS; do \
+        # 1. Define VERSION_GROUP (e.g., 3.14 from 3.14.0)
+        VERSION_GROUP="$(echo "${VERSION}" | cut -d . -f 1,2)"; \
+        \
+        # 2. Look up IDENTITY and ISSUER using the defined VERSION_GROUP
+        IDENTITY="${PYTHON_IDENTITIES[$VERSION_GROUP]}"; \
+        ISSUER="${PYTHON_ISSUERS[$VERSION_GROUP]}"; \
+        \
+      wget --quiet -O python-${VERSION}.tar.xz "https://www.python.org/ftp/python/${VERSION}/Python-$VERSION.tar.xz" \
+      && wget --quiet -O python-${VERSION}.tar.xz.sigstore "https://www.python.org/ftp/python/${VERSION}/Python-$VERSION.tar.xz.sigstore" \
+      # Verify the Python tarball signature with cosign.
+      && cosign verify-blob python-${VERSION}.tar.xz \
+        --certificate-oidc-issuer "${ISSUER}" \
+        --certificate-identity "${IDENTITY}" \
+        --bundle python-${VERSION}.tar.xz.sigstore \
+      && mkdir -p /usr/src/python-${VERSION} \
+      && tar -xJC /usr/src/python-${VERSION} --strip-components=1 -f python-${VERSION}.tar.xz \
+      && rm python-${VERSION}.tar.xz \
+      && cd /usr/src/python-${VERSION} \
+      && ./configure \
+          --enable-shared \
+          --with-system-ffi \
+      && make -j$(nproc) \
+      && make install \
+      && ldconfig \
   ; done \
-  && rm -rf "${GNUPGHOME}" \
   && rm -rf /usr/src/python* \
   && rm -rf ~/.cache/
 
@@ -168,6 +193,7 @@ RUN wget --no-check-certificate -O /tmp/get-pip-3-7.py 'https://bootstrap.pypa.i
   && [ "$(pip list |tac|tac| awk -F '[ ()]+' '$1 == "pip" { print $2; exit }')" = "$PYTHON_PIP_VERSION" ]
 
 # Ensure Pip for all python3 versions
+RUN python3.14 /tmp/get-pip.py
 RUN python3.13 /tmp/get-pip.py
 RUN python3.12 /tmp/get-pip.py
 RUN python3.11 /tmp/get-pip.py
@@ -185,6 +211,7 @@ RUN python3.10 -m pip
 RUN python3.11 -m pip
 RUN python3.12 -m pip
 RUN python3.13 -m pip
+RUN python3.14 -m pip
 
 # Install "setuptools" for Python 3.12+ (see https://docs.python.org/3/whatsnew/3.12.html#distutils)
 RUN python3.12 -m pip install --no-cache-dir setuptools
diff --git a/.kokoro/docker/fetch_gpg_keys.sh b/.kokoro/docker/fetch_gpg_keys.sh
deleted file mode 100755
index 5b8dbbab1ed..00000000000
--- a/.kokoro/docker/fetch_gpg_keys.sh
+++ /dev/null
@@ -1,57 +0,0 @@
-#!/bin/bash
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# A script to fetch gpg keys with retry.
-
-function retry {
-    if [[ "${#}" -le 1 ]]; then
-	echo "Usage: ${0} retry_count commands.."
-	exit 1
-    fi
-    local retries=${1}
-    local command="${@:2}"
-    until [[ "${retries}" -le 0 ]]; do
-	$command && return 0
-	if [[ $? -ne 0 ]]; then
-	    echo "command failed, retrying"
-	    ((retries--))
-	fi
-    done
-    return 1
-}
-
-# 2.7.17 (Benjamin Peterson)
-retry 3 gpg --keyserver keyserver.ubuntu.com --recv-keys \
-      C01E1CAD5EA2C4F0B8E3571504C367C218ADD4FF
-
-# 3.4.10, 3.5.9 (Larry Hastings)
-retry 3 gpg --keyserver keyserver.ubuntu.com --recv-keys \
-      97FC712E4C024BBEA48A61ED3A5CA953F73C700D
-
-# 3.6.9, 3.7.5 (Ned Deily)
-retry 3 gpg --keyserver keyserver.ubuntu.com --recv-keys \
-      0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D
-
-# 3.8.0, 3.9.0 (Łukasz Langa)
-retry 3 gpg --keyserver keyserver.ubuntu.com --recv-keys \
-      E3FF2839C048B25C084DEBE9B26995E310250568
-
-# 3.10.x and 3.11.x (Pablo Galindo Salgado)
-retry 3 gpg --keyserver keyserver.ubuntu.com --recv-keys \
-      A035C8C19219BA821ECEA86B64E628F8D684696D
-
-# 3.12.x and 3.13.x source files and tags (Thomas Wouters)
-retry 3 gpg --keyserver keyserver.ubuntu.com --recv-keys \
-       A821E680E5FA6305
\ No newline at end of file