Bump to 3.14.0a7 (#580)

The big changes here are:

- Switching to zlib-ng on Windows
(python/cpython#131438)
- Using hmac for hashing functions
(python/cpython#130157)

---------

Co-authored-by: Geoffrey Thomas <geofft@ldpreload.com>

Author: zanieb

cpython-unix/extension-modules.yml

@@ -38,9 +38,6 @@ _blake2:
       - Modules/_hacl/include
       - Modules/_hacl/internal
       minimum-python-version: "3.14"
-  links-conditional:
-    - name: :libHacl_Hash_Blake2.a
-      minimum-python-version: "3.14"
   defines-conditional:
     - define: _BSD_SOURCE
       minimum-python-version: "3.14"
@@ -311,6 +308,25 @@ _heapq:
   sources:
     - _heapqmodule.c
 
+_hmac:
+  minimum-python-version: '3.14'
+  sources:
+    - hmacmodule.c
+    - _hacl/Hacl_HMAC.c
+    - _hacl/Hacl_Streaming_HMAC.c
+  includes:
+    - Modules/_hacl/
+    - Modules/_hacl/include/
+  links:
+    - :libHacl_Hash_Blake2.a
+    - :libHacl_Hash_SHA1.a
+    - :libHacl_Hash_SHA2.a
+    - :libHacl_Hash_SHA3.a
+    - :libHacl_Hash_MD5.a
+  defines:
+    - _BSD_SOURCE
+    - _DEFAULT_SOURCE
+
 _imp:
   config-c-only: true
 
@@ -362,6 +378,7 @@ _md5:
   sources-conditional:
     - source: _hacl/Hacl_Hash_MD5.c
       minimum-python-version: "3.12"
+      maximum-python-version: "3.13"
   defines-conditional:
     - define: _BSD_SOURCE
       minimum-python-version: "3.12"
@@ -438,6 +455,7 @@ _sha1:
   sources-conditional:
     - source: _hacl/Hacl_Hash_SHA1.c
       minimum-python-version: "3.12"
+      maximum-python-version: "3.13"
   includes:
     - Modules/_hacl/include
   defines-conditional:
@@ -457,7 +475,9 @@ _sha2:
   minimum-python-version: "3.12"
   sources:
     - sha2module.c
-    - _hacl/Hacl_Hash_SHA2.c
+  sources-conditional:
+    - source: _hacl/Hacl_Hash_SHA2.c
+      maximum-python-version: "3.13"
   includes:
     - Modules/_hacl/include
   defines:
@@ -471,9 +491,9 @@ _sha3:
       maximum-python-version: "3.11"
     - source: sha3module.c
       minimum-python-version: "3.12"
-
     - source: _hacl/Hacl_Hash_SHA3.c
       minimum-python-version: "3.12"
+      maximum-python-version: "3.13"
   includes:
     - Modules/_hacl/include
   defines-conditional:
@@ -700,6 +720,12 @@ _tracemalloc:
   required-targets:
     - .*
 
+_types:
+  minimum-python-version: "3.14"
+  setup-enabled: true
+  sources:
+    - _typesmodule.c
+
 _typing:
   minimum-python-version: "3.11"
   setup-enabled-conditional:

cpython-windows/build.py

@@ -346,6 +346,7 @@ def hack_props(
     pcbuild_path: pathlib.Path,
     arch: str,
     python_version: str,
+    zlib_entry: str,
 ):
     # TODO can we pass props into msbuild.exe?
 
@@ -355,7 +356,7 @@ def hack_props(
     bzip2_version = DOWNLOADS["bzip2"]["version"]
     sqlite_version = DOWNLOADS["sqlite"]["version"]
     xz_version = DOWNLOADS["xz"]["version"]
-    zlib_version = DOWNLOADS["zlib"]["version"]
+    zlib_version = DOWNLOADS[zlib_entry]["version"]
 
     mpdecimal_version = DOWNLOADS["mpdecimal"]["version"]
 
@@ -369,7 +370,8 @@ def hack_props(
     libffi_path = td / "libffi"
     tcltk_path = td / ("cpython-bin-deps-%s" % tcltk_commit)
     xz_path = td / ("xz-%s" % xz_version)
-    zlib_path = td / ("zlib-%s" % zlib_version)
+    zlib_prefix = "cpython-source-deps-" if zlib_entry == "zlib-ng" else ""
+    zlib_path = td / ("%s%s-%s" % (zlib_prefix, zlib_entry, zlib_version))
     mpdecimal_path = td / ("mpdecimal-%s" % mpdecimal_version)
 
     openssl_root = td / "openssl" / arch
@@ -410,6 +412,10 @@ def hack_props(
             elif b"<zlibDir" in line:
                 line = b"<zlibDir>%s\\</zlibDir>" % zlib_path
 
+            # On 3.14+, it's zlib-ng and the name changed
+            elif b"<zlibNgDir" in line:
+                line = b"<zlibNgDir>%s\\</zlibNgDir>" % zlib_path
+
             elif b"<mpdecimalDir" in line:
                 line = b"<mpdecimalDir>%s\\</mpdecimalDir>" % mpdecimal_path
 
@@ -484,6 +490,7 @@ def hack_project_files(
     cpython_source_path: pathlib.Path,
     build_directory: str,
     python_version: str,
+    zlib_entry: str,
 ):
     """Hacks Visual Studio project files to work with our build."""
 
@@ -494,6 +501,7 @@ def hack_project_files(
         pcbuild_path,
         build_directory,
         python_version,
+        zlib_entry,
     )
 
     # Our SQLite directory is named weirdly. This throws off version detection
@@ -913,6 +921,7 @@ def collect_python_build_artifacts(
     arch: str,
     config: str,
     openssl_entry: str,
+    zlib_entry: str,
     freethreaded: bool,
 ):
     """Collect build artifacts from Python.
@@ -993,6 +1002,7 @@ def collect_python_build_artifacts(
     depends_projects |= {
         "liblzma",
         "sqlite3",
+        "zlib-ng",
     }
 
     known_projects = (
@@ -1142,6 +1152,9 @@ def find_additional_dependencies(project: pathlib.Path):
                 if name == "openssl":
                     name = openssl_entry
 
+                if name == "zlib":
+                    name = zlib_entry
+
                 # On 3.14+, we use the latest tcl/tk version
                 if ext == "_tkinter" and python_majmin == "314":
                     name = name.replace("-8612", "")
@@ -1213,16 +1226,19 @@ def build_cpython(
     # The python.props file keys off MSBUILD, so it needs to be set.
     os.environ["MSBUILD"] = str(msbuild)
 
-    bzip2_archive = download_entry("bzip2", BUILD)
-    sqlite_archive = download_entry("sqlite", BUILD)
-    xz_archive = download_entry("xz", BUILD)
-    zlib_archive = download_entry("zlib", BUILD)
-
     python_archive = download_entry(python_entry_name, BUILD)
     entry = DOWNLOADS[python_entry_name]
-
     python_version = entry["version"]
 
+    zlib_entry = (
+        "zlib-ng" if meets_python_minimum_version(python_version, "3.14") else "zlib"
+    )
+
+    bzip2_archive = download_entry("bzip2", BUILD)
+    sqlite_archive = download_entry("sqlite", BUILD)
+    xz_archive = download_entry("xz", BUILD)
+    zlib_archive = download_entry(zlib_entry, BUILD)
+
     setuptools_wheel = download_entry("setuptools", BUILD)
     pip_wheel = download_entry("pip", BUILD)
 
@@ -1328,6 +1344,7 @@ def build_cpython(
             cpython_source_path,
             build_directory,
             python_version=python_version,
+            zlib_entry=zlib_entry,
         )
 
         if pgo:
@@ -1528,6 +1545,7 @@ def build_cpython(
             build_directory,
             artifact_config,
             openssl_entry=openssl_entry,
+            zlib_entry=zlib_entry,
             freethreaded=freethreaded,
         )
 

pythonbuild/downloads.py

@@ -82,10 +82,10 @@
         "python_tag": "cp313",
     },
     "cpython-3.14": {
-        "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0a6.tar.xz",
-        "size": 22956068,
-        "sha256": "8d6181e5331d9a2cd6ca405ae1230e88589a043f4768ebb443d3889d45c1c35c",
-        "version": "3.14.0a6",
+        "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0a7.tar.xz",
+        "size": 23015952,
+        "sha256": "71adbcec3ac9edf93308e55cfb4184f2eb4b16fda2bb0a5a382929ed29c8386d",
+        "version": "3.14.0a7",
         "licenses": ["Python-2.0", "CNRI-Python"],
         "license_file": "LICENSE.cpython.txt",
         "python_tag": "cp314",
@@ -446,4 +446,13 @@
         "licenses": ["Zlib"],
         "license_file": "LICENSE.zlib.txt",
     },
+    "zlib-ng": {
+        "url": "https://github.com/python/cpython-source-deps/archive/refs/tags/zlib-ng-2.2.4.tar.gz",
+        "size": 2415819,
+        "sha256": "00bbd88709bc416cb96160ab61d3e1c8f76e106799af7328d0fe434dc7dd5004",
+        "version": "2.2.4",
+        "library_names": ["z"],
+        "licenses": ["Zlib"],
+        "license_file": "LICENSE.zlib-ng.txt",
+    },
 }

src/validation.rs

@@ -763,6 +763,8 @@ const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
     "_tokenize",
     "_typing",
     "_zoneinfo",
+    "_hmac",
+    "_types",
 ];
 
 const GLOBAL_EXTENSIONS_MACOS: &[&str] = &["_scproxy"];
@@ -1596,7 +1598,7 @@ fn validate_extension_modules(
         ]);
     }
 
-    if is_windows && matches!(python_major_minor, "3.13") {
+    if is_windows && matches!(python_major_minor, "3.13" | "3.14") {
         wanted.extend(["_suggestions"]);
     }