dev-python/pypi-attestations: Skip provenance check on upgrade cycle

Detect when dev-python/sigstore has been upgraded already but
dev-python/pypi-attestations are still old, and skip the provenance
check for a clean upgrade.  This should be safe since the distfiles is
still verified against our Manifests.

Closes: https://bugs.gentoo.org/969332
Signed-off-by: Michał Górny <mgorny@gentoo.org>

dev-python/pypi-attestations/pypi-attestations-0.0.29.ebuild

@@ -38,3 +38,17 @@ BDEPEND="
 
 EPYTEST_PLUGINS=()
 distutils_enable_tests pytest
+
+src_unpack() {
+	if use verify-provenance &&
+		has_version "<dev-python/pypi-attestations-0.0.28" &&
+		has_version ">=dev-python/sigstore-4"
+	then
+		# https://bugs.gentoo.org/969332
+		einfo "Skipping provenance check due to sigstore/pypi-attestations upgrade cycle"
+		default
+		return
+	fi
+
+	pypi_src_unpack
+}