Add support for Python 3.14 on macOS and GNU Linux (astral-sh#443)

The biggest change seems to be around blake2's implementation.

I figure I'll follow-up on musl Linux separately.

Author: zanieb

Diff for: ci-matrix.py

@@ -71,7 +71,11 @@ def should_include_entry(entry: dict[str, str], filters: dict[str, set[str]]) ->
     if filters.get("arch") and entry["arch"] not in filters["arch"]:
         return False
 
-    if filters.get("libc") and entry.get("libc") not in filters["libc"]:
+    if (
+        filters.get("libc")
+        and entry.get("libc")
+        and entry["libc"] not in filters["libc"]
+    ):
         return False
 
     if filters.get("build"):

Diff for: ci-targets.yaml

@@ -9,6 +9,7 @@ darwin:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -26,6 +27,7 @@ darwin:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -45,6 +47,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -65,6 +68,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -85,6 +89,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -105,6 +110,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -125,6 +131,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -145,6 +152,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -165,6 +173,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -185,6 +194,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -205,6 +215,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt

Diff for: cpython-unix/Makefile

@@ -6,7 +6,7 @@ BUILD := $(HERE)/build.py
 NULL :=
 SPACE := $(subst ,, )
 
-ALL_PYTHON_VERSIONS := 3.9 3.10 3.11 3.12 3.13
+ALL_PYTHON_VERSIONS := 3.9 3.10 3.11 3.12 3.13 3.14
 
 ifndef PYBUILD_TARGET_TRIPLE
     $(error PYBUILD_TARGET_TRIPLE not defined)

Diff for: cpython-unix/build-cpython.sh

@@ -70,12 +70,14 @@ cat Makefile.extra
 pushd Python-${PYTHON_VERSION}
 
 # configure doesn't support cross-compiling on Apple. Teach it.
-if [ "${PYTHON_MAJMIN_VERSION}" = "3.13" ]; then
-    patch -p1 -i ${ROOT}/patch-apple-cross-3.13.patch
-elif [ "${PYTHON_MAJMIN_VERSION}" = "3.12" ]; then
-    patch -p1 -i ${ROOT}/patch-apple-cross-3.12.patch
-else
-    patch -p1 -i ${ROOT}/patch-apple-cross.patch
+if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
+    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
+        patch -p1 -i ${ROOT}/patch-apple-cross-3.13.patch
+    elif [ "${PYTHON_MAJMIN_VERSION}" = "3.12" ]; then
+        patch -p1 -i ${ROOT}/patch-apple-cross-3.12.patch
+    else
+        patch -p1 -i ${ROOT}/patch-apple-cross.patch
+    fi
 fi
 
 # This patch is slightly different on Python 3.10+.
@@ -94,7 +96,9 @@ fi
 # Configure nerfs RUNSHARED when cross-compiling, which prevents PGO from running when
 # we can in fact run the target binaries (e.g. x86_64 host and i686 target). Undo that.
 if [ -n "${CROSS_COMPILING}" ]; then
-    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
+    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
+        patch -p1 -i ${ROOT}/patch-dont-clear-runshared-14.patch
+    elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
         patch -p1 -i ${ROOT}/patch-dont-clear-runshared-13.patch
     elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_11}" ]; then
         patch -p1 -i ${ROOT}/patch-dont-clear-runshared.patch
@@ -471,6 +475,18 @@ if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
     CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_ptsname_r=no"
 fi
 
+# explicit_bzero is only available in glibc 2.25+, but we target a lower version for compatibility.
+# it's only needed for the HACL Blake2 implementation in Python 3.14+
+if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}"  ]; then
+    CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_explicit_bzero=no"
+fi
+
+# On 3.14+ `test_strftime_y2k` fails when cross-compiling for `x86_64_v2` and `x86_64_v3` targets on
+# Linux, so we ignore it. See https://github.com/python/cpython/issues/128104
+if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" && -n "${CROSS_COMPILING}" && "${PYBUILD_PLATFORM}" != "macos" ]]; then
+    export PROFILE_TASK='-m test --pgo --ignore test_strftime_y2k'
+fi
+
 # We use ndbm on macOS and BerkeleyDB elsewhere.
 if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
     CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --with-dbmliborder=ndbm"

Diff for: cpython-unix/build-main.py

@@ -11,6 +11,7 @@
 import subprocess
 import sys
 
+from pythonbuild.cpython import meets_python_minimum_version
 from pythonbuild.downloads import DOWNLOADS
 from pythonbuild.utils import (
     compress_python_archive,
@@ -68,6 +69,7 @@ def main():
             "cpython-3.11",
             "cpython-3.12",
             "cpython-3.13",
+            "cpython-3.14",
         },
         default="cpython-3.11",
         help="Python distribution to build",
@@ -164,7 +166,9 @@ def main():
         release_tag = release_tag_from_git()
 
     # Guard against accidental misuse of the free-threaded flag with older versions
-    if "freethreaded" in args.options and python_majmin not in ("3.13",):
+    if "freethreaded" in args.options and not meets_python_minimum_version(
+        python_majmin, "3.13"
+    ):
         print(
             "Invalid build option: 'freethreaded' is only compatible with CPython 3.13+ (got %s)"
             % cpython_version

Diff for: cpython-unix/build.py

@@ -465,7 +465,7 @@ def build_cpython_host(
 
         # Set environment variables allowing convenient testing for Python
         # version ranges.
-        for v in ("3.9", "3.10", "3.11", "3.12", "3.13"):
+        for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14"):
             normal_version = v.replace(".", "_")
 
             if meets_python_minimum_version(python_version, v):
@@ -801,7 +801,7 @@ def build_cpython(
 
         # Set environment variables allowing convenient testing for Python
         # version ranges.
-        for v in ("3.9", "3.10", "3.11", "3.12", "3.13"):
+        for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14"):
             normal_version = v.replace(".", "_")
 
             if meets_python_minimum_version(python_version, v):
@@ -1223,6 +1223,7 @@ def main():
             "cpython-3.11",
             "cpython-3.12",
             "cpython-3.13",
+            "cpython-3.14",
         ):
             build_cpython(
                 settings,

Diff for: cpython-unix/extension-modules.yml

@@ -19,10 +19,36 @@ _bisect:
     - _bisectmodule.c
 
 _blake2:
-  sources:
-    - _blake2/blake2module.c
-    - _blake2/blake2b_impl.c
-    - _blake2/blake2s_impl.c
+  # In 3.14+, Blake2 is provided by Hacl*
+  sources-conditional:
+    - sources:
+      - _blake2/blake2module.c
+      - _blake2/blake2b_impl.c
+      - _blake2/blake2s_impl.c
+      maximum-python-version: "3.13"
+    - sources:
+      - blake2module.c
+      - _hacl/Hacl_Hash_Blake2s.c
+      - _hacl/Hacl_Hash_Blake2b.c
+      - _hacl/Lib_Memzero0.c
+      minimum-python-version: "3.14"
+  includes-conditional:
+    - includes:
+      - Modules/_hacl
+      - Modules/_hacl/include
+      - Modules/_hacl/internal
+      minimum-python-version: "3.14"
+  links-conditional:
+    - name: :libHacl_Hash_Blake2.a
+      minimum-python-version: "3.14"
+  defines-conditional:
+    - define: _BSD_SOURCE
+      minimum-python-version: "3.14"
+    - define: _DEFAULT_SOURCE
+      minimum-python-version: "3.14"
+    # Disable `explicit_bzero`, it requires glib 2.25+
+    - define: LINUX_NO_EXPLICIT_BZERO
+      minimum-python-version: "3.14"
 
 _bz2:
   sources:
@@ -355,6 +381,9 @@ _multiprocessing:
 _opcode:
   sources:
     - _opcode.c
+  setup-enabled-conditional:
+    - enabled: true
+      minimum-python-version: "3.14"
 
 _operator:
   setup-enabled: true

Diff for: cpython-unix/patch-dont-clear-runshared-14.patch

@@ -0,0 +1,15 @@
+diff --git a/configure.ac b/configure.ac
+index bd0221481c5..f2fb52c1efc 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1605,10 +1605,6 @@ else # shared is disabled
+ fi
+ AC_MSG_RESULT([$LDLIBRARY])
+ 
+-if test "$cross_compiling" = yes; then
+-  RUNSHARED=
+-fi
+-
+ # HOSTRUNNER - Program to run CPython for the host platform
+ AC_MSG_CHECKING([HOSTRUNNER])
+ if test -z "$HOSTRUNNER"