From 398554702d07add84f99875089e81a9ddd2b0127 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 15:21:16 -0600
Subject: [PATCH 01/21] Add support for Python 3.14 on GNU Linux

---
 ci-targets.yaml                    |  9 +++++++++
 cpython-unix/Makefile              |  2 +-
 cpython-unix/build-main.py         |  3 ++-
 cpython-unix/build.py              |  5 +++--
 cpython-unix/extension-modules.yml |  3 +++
 cpython-unix/targets.yml           | 18 ++++++++++++++++++
 pythonbuild/downloads.py           |  9 +++++++++
 src/validation.rs                  |  2 ++
 8 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/ci-targets.yaml b/ci-targets.yaml
index 940f1454..9025882f 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -45,6 +45,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -65,6 +66,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -85,6 +87,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -105,6 +108,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -125,6 +129,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
@@ -145,6 +150,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -165,6 +171,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -185,6 +192,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -205,6 +213,7 @@ linux:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - noopt
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index 779bc12e..0e859784 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -6,7 +6,7 @@ BUILD := $(HERE)/build.py
 NULL :=
 SPACE := $(subst ,, )
 
-ALL_PYTHON_VERSIONS := 3.9 3.10 3.11 3.12 3.13
+ALL_PYTHON_VERSIONS := 3.9 3.10 3.11 3.12 3.13 3.14
 
 ifndef PYBUILD_TARGET_TRIPLE
     $(error PYBUILD_TARGET_TRIPLE not defined)
diff --git a/cpython-unix/build-main.py b/cpython-unix/build-main.py
index e837dd5d..965e2135 100755
--- a/cpython-unix/build-main.py
+++ b/cpython-unix/build-main.py
@@ -68,6 +68,7 @@ def main():
             "cpython-3.11",
             "cpython-3.12",
             "cpython-3.13",
+            "cpython-3.14",
         },
         default="cpython-3.11",
         help="Python distribution to build",
@@ -164,7 +165,7 @@ def main():
         release_tag = release_tag_from_git()
 
     # Guard against accidental misuse of the free-threaded flag with older versions
-    if "freethreaded" in args.options and python_majmin not in ("3.13",):
+    if "freethreaded" in args.options and python_majmin not in ("3.13", "3.14"):
         print(
             "Invalid build option: 'freethreaded' is only compatible with CPython 3.13+ (got %s)"
             % cpython_version
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 9bfc93ef..f7ee174e 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -465,7 +465,7 @@ def build_cpython_host(
 
         # Set environment variables allowing convenient testing for Python
         # version ranges.
-        for v in ("3.9", "3.10", "3.11", "3.12", "3.13"):
+        for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14"):
             normal_version = v.replace(".", "_")
 
             if meets_python_minimum_version(python_version, v):
@@ -801,7 +801,7 @@ def build_cpython(
 
         # Set environment variables allowing convenient testing for Python
         # version ranges.
-        for v in ("3.9", "3.10", "3.11", "3.12", "3.13"):
+        for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14"):
             normal_version = v.replace(".", "_")
 
             if meets_python_minimum_version(python_version, v):
@@ -1223,6 +1223,7 @@ def main():
             "cpython-3.11",
             "cpython-3.12",
             "cpython-3.13",
+            "cpython-3.14",
         ):
             build_cpython(
                 settings,
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 36831666..3afbe1cd 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -355,6 +355,9 @@ _multiprocessing:
 _opcode:
   sources:
     - _opcode.c
+  setup-enabled-conditional:
+    - enabled: true
+      minimum-python-version: "3.14"
 
 _operator:
   setup-enabled: true
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index c01d93e2..0aba1030 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -64,6 +64,7 @@ aarch64-apple-darwin:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -153,6 +154,7 @@ aarch64-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   docker_image_suffix: .cross
   host_cc: /usr/bin/x86_64-linux-gnu-gcc
   host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -232,6 +234,7 @@ armv7-unknown-linux-gnueabi:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   docker_image_suffix: .cross
   host_cc: /usr/bin/x86_64-linux-gnu-gcc
   host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -271,6 +274,7 @@ armv7-unknown-linux-gnueabihf:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   docker_image_suffix: .cross
   host_cc: /usr/bin/x86_64-linux-gnu-gcc
   host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -310,6 +314,7 @@ i686-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -354,6 +359,7 @@ mips-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   docker_image_suffix: .cross
   host_cc: /usr/bin/x86_64-linux-gnu-gcc
   host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -393,6 +399,7 @@ mipsel-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   docker_image_suffix: .cross
   host_cc: /usr/bin/x86_64-linux-gnu-gcc
   host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -432,6 +439,7 @@ ppc64le-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   docker_image_suffix: .cross
   host_cc: /usr/bin/x86_64-linux-gnu-gcc
   host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -471,6 +479,7 @@ s390x-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   docker_image_suffix: .cross
   host_cc: /usr/bin/x86_64-linux-gnu-gcc
   host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -554,6 +563,7 @@ x86_64-apple-darwin:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   apple_sdk_platform: macosx
   host_cc: clang
@@ -723,6 +733,7 @@ x86_64-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -767,6 +778,7 @@ x86_64_v2-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -812,6 +824,7 @@ x86_64_v3-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -857,6 +870,7 @@ x86_64_v4-unknown-linux-gnu:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -902,6 +916,7 @@ x86_64-unknown-linux-musl:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -944,6 +959,7 @@ x86_64_v2-unknown-linux-musl:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -987,6 +1003,7 @@ x86_64_v3-unknown-linux-musl:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
@@ -1030,6 +1047,7 @@ x86_64_v4-unknown-linux-musl:
     - '3.11'
     - '3.12'
     - '3.13'
+    - '3.14'
   needs_toolchain: true
   host_cc: clang
   host_cxx: clang++
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index f444a4e8..6505c811 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -79,6 +79,15 @@
         "license_file": "LICENSE.cpython.txt",
         "python_tag": "cp313",
     },
+    "cpython-3.14": {
+        "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0a3.tar.xz",
+        "size": 22749680,
+        "sha256": "94349df207456a575a8867c20b4ca434f870e1920dcdcc8fdf797e1af49abe90",
+        "version": "3.14.0a3",
+        "licenses": ["Python-2.0", "CNRI-Python"],
+        "license_file": "LICENSE.cpython.txt",
+        "python_tag": "cp314",
+    },
     "expat": {
         "url": "https://github.com/libexpat/libexpat/releases/download/R_2_6_3/expat-2.6.3.tar.xz",
         "size": 485600,
diff --git a/src/validation.rs b/src/validation.rs
index 7f5e367c..c613ae70 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -1638,6 +1638,8 @@ fn validate_distribution(
         "3.12"
     } else if dist_filename.starts_with("cpython-3.13.") {
         "3.13"
+    } else if dist_filename.starts_with("cpython-3.14.") {
+        "3.14"
     } else {
         return Err(anyhow!("could not parse Python version from filename"));
     };

From cd9dbfd9f1f74d869e61564bc4ef05957bcdcb87 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 16:06:11 -0600
Subject: [PATCH 02/21] Only apply Apple cross-compile patches on macOS

---
 cpython-unix/build-cpython.sh | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 671ce34c..4a839046 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -70,12 +70,14 @@ cat Makefile.extra
 pushd Python-${PYTHON_VERSION}
 
 # configure doesn't support cross-compiling on Apple. Teach it.
-if [ "${PYTHON_MAJMIN_VERSION}" = "3.13" ]; then
-    patch -p1 -i ${ROOT}/patch-apple-cross-3.13.patch
-elif [ "${PYTHON_MAJMIN_VERSION}" = "3.12" ]; then
-    patch -p1 -i ${ROOT}/patch-apple-cross-3.12.patch
-else
-    patch -p1 -i ${ROOT}/patch-apple-cross.patch
+if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
+    if [ "${PYTHON_MAJMIN_VERSION}" = "3.13" ]; then
+        patch -p1 -i ${ROOT}/patch-apple-cross-3.13.patch
+    elif [ "${PYTHON_MAJMIN_VERSION}" = "3.12" ]; then
+        patch -p1 -i ${ROOT}/patch-apple-cross-3.12.patch
+    else
+        patch -p1 -i ${ROOT}/patch-apple-cross.patch
+    fi
 fi
 
 # This patch is slightly different on Python 3.10+.

From dc6a50f3b823b0b49d0e26ab3f82d06b9a623606 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 16:43:22 -0600
Subject: [PATCH 03/21] Apply 3.13 apple-cross patch to 3.14

---
 cpython-unix/build-cpython.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 4a839046..4a21f9fe 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -71,7 +71,7 @@ pushd Python-${PYTHON_VERSION}
 
 # configure doesn't support cross-compiling on Apple. Teach it.
 if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
-    if [ "${PYTHON_MAJMIN_VERSION}" = "3.13" ]; then
+    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
         patch -p1 -i ${ROOT}/patch-apple-cross-3.13.patch
     elif [ "${PYTHON_MAJMIN_VERSION}" = "3.12" ]; then
         patch -p1 -i ${ROOT}/patch-apple-cross-3.12.patch

From 6ec00cf694abf132b9c6212902419976041c12f9 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 16:48:30 -0600
Subject: [PATCH 04/21] Fix "runshared" patch on 3.14

---
 cpython-unix/build-cpython.sh                    |  4 +++-
 cpython-unix/patch-dont-clear-runshared-14.patch | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 cpython-unix/patch-dont-clear-runshared-14.patch

diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 4a21f9fe..8a531409 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -96,7 +96,9 @@ fi
 # Configure nerfs RUNSHARED when cross-compiling, which prevents PGO from running when
 # we can in fact run the target binaries (e.g. x86_64 host and i686 target). Undo that.
 if [ -n "${CROSS_COMPILING}" ]; then
-    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
+    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
+        patch -p1 -i ${ROOT}/patch-dont-clear-runshared-14.patch
+    elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
         patch -p1 -i ${ROOT}/patch-dont-clear-runshared-13.patch
     elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_11}" ]; then
         patch -p1 -i ${ROOT}/patch-dont-clear-runshared.patch
diff --git a/cpython-unix/patch-dont-clear-runshared-14.patch b/cpython-unix/patch-dont-clear-runshared-14.patch
new file mode 100644
index 00000000..9d410349
--- /dev/null
+++ b/cpython-unix/patch-dont-clear-runshared-14.patch
@@ -0,0 +1,15 @@
+diff --git a/configure b/configure
+index 57be576e3ca..a87c6eb8f2e 100755
+--- a/configure
++++ b/configure
+@@ -7617,10 +7617,6 @@ fi
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $LDLIBRARY" >&5
+ printf "%s\n" "$LDLIBRARY" >&6; }
+ 
+-if test "$cross_compiling" = yes; then
+-  RUNSHARED=
+-fi
+-
+ # HOSTRUNNER - Program to run CPython for the host platform
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking HOSTRUNNER" >&5
+ printf %s "checking HOSTRUNNER... " >&6; }

From 2094ced7ac6aea28b8207062a00359a5b82ecaeb Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 17:18:03 -0600
Subject: [PATCH 05/21] Drop `_blake2` from expected extension modules

---
 cpython-unix/extension-modules.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 3afbe1cd..b46a098d 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -19,6 +19,7 @@ _bisect:
     - _bisectmodule.c
 
 _blake2:
+  maximum-python-version: "3.13"
   sources:
     - _blake2/blake2module.c
     - _blake2/blake2b_impl.c

From 0e5f479d4a69c3e276b87a8bde94625ad4737ee9 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 17:21:00 -0600
Subject: [PATCH 06/21] Use `meets_python_minimum_version` for free-threaded
 safety check

---
 cpython-unix/build-main.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cpython-unix/build-main.py b/cpython-unix/build-main.py
index 965e2135..a41e333b 100755
--- a/cpython-unix/build-main.py
+++ b/cpython-unix/build-main.py
@@ -11,6 +11,7 @@
 import subprocess
 import sys
 
+from pythonbuild.cpython import meets_python_minimum_version
 from pythonbuild.downloads import DOWNLOADS
 from pythonbuild.utils import (
     compress_python_archive,
@@ -165,7 +166,9 @@ def main():
         release_tag = release_tag_from_git()
 
     # Guard against accidental misuse of the free-threaded flag with older versions
-    if "freethreaded" in args.options and python_majmin not in ("3.13", "3.14"):
+    if "freethreaded" in args.options and not meets_python_minimum_version(
+        python_majmin, "3.13"
+    ):
         print(
             "Invalid build option: 'freethreaded' is only compatible with CPython 3.13+ (got %s)"
             % cpython_version

From d5131a57950ce443267f3dc0aa80158d6a016501 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 17:54:57 -0600
Subject: [PATCH 07/21] Add 3.14 to validation

---
 src/validation.rs | 68 +++++++++++++++++++++++++++++++++++++----------
 1 file changed, 54 insertions(+), 14 deletions(-)

diff --git a/src/validation.rs b/src/validation.rs
index c613ae70..bbc3ae7b 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -129,6 +129,8 @@ const PE_ALLOWED_LIBRARIES: &[&str] = &[
     "python312.dll",
     "python313.dll",
     "python313t.dll",
+    "python314.dll",
+    "python314t.dll",
     "sqlite3.dll",
     "tcl86t.dll",
     "tk86t.dll",
@@ -304,6 +306,26 @@ static DARWIN_ALLOWED_DYLIBS: Lazy<Vec<MachOAllowedDylib>> = Lazy::new(|| {
                 max_compatibility_version: "3.13.0".try_into().unwrap(),
                 required: false,
             },
+            MachOAllowedDylib {
+                name: "@executable_path/../lib/libpython3.14.dylib".to_string(),
+                max_compatibility_version: "3.14.0".try_into().unwrap(),
+                required: false,
+            },
+            MachOAllowedDylib {
+                name: "@executable_path/../lib/libpython3.14d.dylib".to_string(),
+                max_compatibility_version: "3.14.0".try_into().unwrap(),
+                required: false,
+            },
+            MachOAllowedDylib {
+                name: "@executable_path/../lib/libpython3.14t.dylib".to_string(),
+                max_compatibility_version: "3.14.0".try_into().unwrap(),
+                required: false,
+            },
+            MachOAllowedDylib {
+                name: "@executable_path/../lib/libpython3.14td.dylib".to_string(),
+                max_compatibility_version: "3.14.0".try_into().unwrap(),
+                required: false,
+            },
             MachOAllowedDylib {
                 name: "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit".to_string(),
                 max_compatibility_version: "45.0.0".try_into().unwrap(),
@@ -581,7 +603,6 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
     "_ast",
     "_asyncio",
     "_bisect",
-    "_blake2",
     "_bz2",
     "_codecs",
     "_codecs_cn",
@@ -667,6 +688,7 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_9: &[&str] = &[
     "audioop",
+    "_blake2",
     "_peg_parser",
     "_sha256",
     "_sha512",
@@ -677,6 +699,7 @@ const GLOBAL_EXTENSIONS_PYTHON_3_9: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] = &[
     "audioop",
+    "_blake2",
     "_sha256",
     "_sha512",
     "_xxsubinterpreters",
@@ -685,6 +708,7 @@ const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
     "audioop",
+    "_blake2",
     "_sha256",
     "_sha512",
     "_tokenize",
@@ -695,6 +719,7 @@ const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_12: &[&str] = &[
     "audioop",
+    "_blake2",
     "_sha2",
     "_tokenize",
     "_typing",
@@ -704,6 +729,18 @@ const GLOBAL_EXTENSIONS_PYTHON_3_12: &[&str] = &[
 ];
 
 const GLOBAL_EXTENSIONS_PYTHON_3_13: &[&str] = &[
+    "_blake2",
+    "_interpchannels",
+    "_interpqueues",
+    "_interpreters",
+    "_sha2",
+    "_sysconfig",
+    "_tokenize",
+    "_typing",
+    "_zoneinfo",
+];
+
+const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
     "_interpchannels",
     "_interpqueues",
     "_interpreters",
@@ -717,7 +754,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_13: &[&str] = &[
 const GLOBAL_EXTENSIONS_MACOS: &[&str] = &["_scproxy"];
 
 const GLOBAL_EXTENSIONS_POSIX: &[&str] = &[
-    "_crypt",
     "_ctypes_test",
     "_curses",
     "_curses_panel",
@@ -735,6 +771,8 @@ const GLOBAL_EXTENSIONS_POSIX: &[&str] = &[
     "termios",
 ];
 
+const GLOBAL_EXTENSIONS_POSIX_PRE_3_13: &[&str] = &["_crypt"];
+
 const GLOBAL_EXTENSIONS_LINUX_PRE_3_13: &[&str] = &["spwd"];
 
 const GLOBAL_EXTENSIONS_WINDOWS: &[&str] = &[
@@ -1070,7 +1108,6 @@ fn parse_version_nibbles(v: u32) -> semver::Version {
 fn validate_macho<Mach: MachHeader<Endian = Endianness>>(
     context: &mut ValidationContext,
     target_triple: &str,
-    python_major_minor: &str,
     advertised_target_version: &str,
     advertised_sdk_version: &str,
     path: &Path,
@@ -1365,7 +1402,6 @@ fn validate_possible_object_file(
                 validate_macho(
                     &mut context,
                     triple,
-                    python_major_minor,
                     json.apple_sdk_deployment_target
                         .as_ref()
                         .expect("apple_sdk_deployment_target should be set"),
@@ -1383,7 +1419,6 @@ fn validate_possible_object_file(
                 validate_macho(
                     &mut context,
                     triple,
-                    python_major_minor,
                     json.apple_sdk_deployment_target
                         .as_ref()
                         .expect("apple_sdk_deployment_target should be set"),
@@ -1454,6 +1489,9 @@ fn validate_extension_modules(
         "3.13" => {
             wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_13);
         }
+        "3.14" => {
+            wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_14);
+        }
         _ => {
             panic!("unhandled Python version: {}", python_major_minor);
         }
@@ -1461,9 +1499,11 @@ fn validate_extension_modules(
 
     if is_macos {
         wanted.extend(GLOBAL_EXTENSIONS_POSIX);
-        if python_major_minor == "3.13" {
-            wanted.remove("_crypt");
+
+        if matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
+            wanted.extend(GLOBAL_EXTENSIONS_POSIX_PRE_3_13);
         }
+
         wanted.extend(GLOBAL_EXTENSIONS_MACOS);
     }
 
@@ -1483,11 +1523,11 @@ fn validate_extension_modules(
 
     if is_linux {
         wanted.extend(GLOBAL_EXTENSIONS_POSIX);
-        // TODO: If there are more differences for `GLOBAL_EXTENSIONS_POSIX` in future Python
-        // versions, we should move the `_crypt` special-case into a constant
-        if python_major_minor == "3.13" {
-            wanted.remove("_crypt");
+
+        if matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
+            wanted.extend(GLOBAL_EXTENSIONS_POSIX_PRE_3_13);
         }
+
         if matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
             wanted.extend(GLOBAL_EXTENSIONS_LINUX_PRE_3_13);
         }
@@ -1497,7 +1537,7 @@ fn validate_extension_modules(
         }
     }
 
-    if (is_linux || is_macos) {
+    if is_linux || is_macos {
         wanted.extend([
             "_testbuffer",
             "_testimportmultiple",
@@ -1506,11 +1546,11 @@ fn validate_extension_modules(
         ]);
     }
 
-    if (is_linux || is_macos) && python_major_minor == "3.13" {
+    if (is_linux || is_macos) && matches!(python_major_minor, "3.13" | "3.14") {
         wanted.extend(["_suggestions", "_testexternalinspection"]);
     }
 
-    if (is_linux || is_macos) && matches!(python_major_minor, "3.12" | "3.13") {
+    if (is_linux || is_macos) && matches!(python_major_minor, "3.12" | "3.13" | "3.14") {
         wanted.insert("_testsinglephase");
     }
 

From 871c190b1ca186fbebed90f9687a683a9c32be61 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 17:55:39 -0600
Subject: [PATCH 08/21] Enable 3.14 for macOS builds

---
 ci-targets.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ci-targets.yaml b/ci-targets.yaml
index 9025882f..fa20735e 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -9,6 +9,7 @@ darwin:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto
@@ -26,6 +27,7 @@ darwin:
       - "3.11"
       - "3.12"
       - "3.13"
+      - "3.14"
     build_options:
       - debug
       - pgo+lto

From 7869c0a96282e3010d9aaaebf2c7b07d732145f2 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 22:24:08 -0600
Subject: [PATCH 09/21] Fix libc filtering in the matrix generator

---
 ci-matrix.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ci-matrix.py b/ci-matrix.py
index 2f7fc193..21363cc2 100644
--- a/ci-matrix.py
+++ b/ci-matrix.py
@@ -71,7 +71,11 @@ def should_include_entry(entry: dict[str, str], filters: dict[str, set[str]]) ->
     if filters.get("arch") and entry["arch"] not in filters["arch"]:
         return False
 
-    if filters.get("libc") and entry.get("libc") not in filters["libc"]:
+    if (
+        filters.get("libc")
+        and entry.get("libc")
+        and entry["libc"] not in filters["libc"]
+    ):
         return False
 
     if filters.get("build"):

From de2aea31f016090221d5b5bf46ad00fb0f1803ad Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 23:32:04 -0600
Subject: [PATCH 10/21] Add multiple path support to `includes-conditional` and
 `sources-conditional`

---
 pythonbuild/cpython.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pythonbuild/cpython.py b/pythonbuild/cpython.py
index c499cc0f..7b620c8b 100644
--- a/pythonbuild/cpython.py
+++ b/pythonbuild/cpython.py
@@ -511,7 +511,10 @@ def derive_setup_local(
             )
 
             if target_match and (python_min_match and python_max_match):
-                line += f" {entry['source']}"
+                if source := entry.get("source"):
+                    line += f" {source}"
+                for source in entry.get("sources", []):
+                    line += f" {source}"
 
         for define in info.get("defines", []):
             line += f" -D{define}"
@@ -549,7 +552,11 @@ def derive_setup_local(
             )
 
             if target_match and (python_min_match and python_max_match):
-                line += f" -I{entry['path']}"
+                # TODO: Change to `include` and drop support for `path`
+                if include := entry.get("path"):
+                    line += f" -I{include}"
+                for include in entry.get("includes", []):
+                    line += f" -I{include}"
 
         for path in info.get("includes-deps", []):
             # Includes are added to global search path.

From 76d9da1eada70f155049ef9a9170754150a3a9a3 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 23:59:23 -0600
Subject: [PATCH 11/21] Add min/max-python-version support to
 `links-conditional`

---
 pythonbuild/cpython.py | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pythonbuild/cpython.py b/pythonbuild/cpython.py
index 7b620c8b..50ad6f70 100644
--- a/pythonbuild/cpython.py
+++ b/pythonbuild/cpython.py
@@ -569,7 +569,19 @@ def derive_setup_local(
             line += " %s" % link_for_target(lib, target_triple)
 
         for entry in info.get("links-conditional", []):
-            if any(re.match(p, target_triple) for p in entry["targets"]):
+            if targets := entry.get("targets", []):
+                target_match = any(re.match(p, target_triple) for p in targets)
+            else:
+                target_match = True
+
+            python_min_match = meets_python_minimum_version(
+                python_version, entry.get("minimum-python-version", "1.0")
+            )
+            python_max_match = meets_python_maximum_version(
+                python_version, entry.get("maximum-python-version", "100.0")
+            )
+
+            if target_match and (python_min_match and python_max_match):
                 line += " %s" % link_for_target(entry["name"], target_triple)
 
         if "-apple-" in target_triple:

From dd15340206b51aa0a3f957d89b0bf1750e329a9f Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Wed, 18 Dec 2024 23:10:57 -0600
Subject: [PATCH 12/21] Split `_blake` extension configuratoin for 3.14

---
 cpython-unix/extension-modules.yml | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index b46a098d..c02fea55 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -19,11 +19,28 @@ _bisect:
     - _bisectmodule.c
 
 _blake2:
-  maximum-python-version: "3.13"
-  sources:
-    - _blake2/blake2module.c
-    - _blake2/blake2b_impl.c
-    - _blake2/blake2s_impl.c
+  # In 3.14+, Blake2 is provided by Hacl*
+  sources-conditional:
+    - sources:
+      - _blake2/blake2module.c
+      - _blake2/blake2b_impl.c
+      - _blake2/blake2s_impl.c
+      maximum-python-version: "3.13"
+    - sources:
+      - blake2module.c
+      - _hacl/Hacl_Hash_Blake2s.c
+      - _hacl/Hacl_Hash_Blake2b.c
+      - _hacl/Lib_Memzero0.c
+      minimum-python-version: "3.14"
+  includes-conditional:
+    - includes:
+      - Modules/_hacl
+      - Modules/_hacl/include
+      - Modules/_hacl/internal
+      minimum-python-version: "3.14"
+  links-conditional:
+    - name: :libHacl_Hash_Blake2.a
+      minimum-python-version: "3.14"
 
 _bz2:
   sources:

From 33b1bee1f18cff587d03bac84705389ca0ec281c Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 12:07:51 -0600
Subject: [PATCH 13/21] Bump minimum macOS version from 10.9 -> 10.15 on x86_64

This is required for the new `_blake2` implementations, we should also upstream runtime checks
---
 cpython-unix/targets.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index 0aba1030..a442cc87 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -572,7 +572,7 @@ x86_64-apple-darwin:
   target_cflags:
     - '-arch'
     - 'x86_64'
-    - '-mmacosx-version-min=10.9'
+    - '-mmacosx-version-min=10.15'
     # Suppress extremely verbose warnings we see with LLVM 10.
     - '-Wno-nullability-completeness'
     - '-Wno-expansion-to-defined'
@@ -587,7 +587,7 @@ x86_64-apple-darwin:
   target_ldflags:
     - '-arch'
     - 'x86_64'
-    - '-mmacosx-version-min=10.9'
+    - '-mmacosx-version-min=10.15'
   needs:
     - autoconf
     - bzip2

From 504468a77e408f12dc5dd3dccb771ea9014c78c8 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 12:27:29 -0600
Subject: [PATCH 14/21] Add `_BSD_SOURCE` and `_DEFAULT_SOURCE`

To attempt to fix `_hacl` missing symbols
---
 cpython-unix/extension-modules.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index c02fea55..f3ace564 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -41,6 +41,11 @@ _blake2:
   links-conditional:
     - name: :libHacl_Hash_Blake2.a
       minimum-python-version: "3.14"
+  defines-conditional:
+    - define: _BSD_SOURCE
+      minimum-python-version: "3.14"
+    - define: _DEFAULT_SOURCE
+      minimum-python-version: "3.14"
 
 _bz2:
   sources:

From 9dd6bd500709d2723e84566c0776909c5f06f29c Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 12:54:08 -0600
Subject: [PATCH 15/21] Set `ac_cv_func_explicit_bzero=no`

---
 cpython-unix/build-cpython.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 8a531409..afb9fe83 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -475,6 +475,12 @@ if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
     CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_ptsname_r=no"
 fi
 
+# explicit_bzero is only available in glibc 2.25+, but we target a lower version for compatibility.
+# it's only needed for the HACL Blake2 implementation in Python 3.14+
+if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}"  ]; then
+    CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_explicit_bzero=no"
+fi
+
 # We use ndbm on macOS and BerkeleyDB elsewhere.
 if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
     CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --with-dbmliborder=ndbm"

From eaa5ab9a9ba01843170077c7d6f37ba195d64df3 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 13:51:36 -0600
Subject: [PATCH 16/21] Fix cross-compilation for macOS x86_64

---
 cpython-unix/build-cpython.sh                 |  4 +-
 cpython-unix/patch-apple-cross-3.14.patch     | 65 +++++++++++++++++++
 .../patch-dont-clear-runshared-14.patch       | 18 ++---
 3 files changed, 77 insertions(+), 10 deletions(-)
 create mode 100644 cpython-unix/patch-apple-cross-3.14.patch

diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index afb9fe83..6345227c 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -71,7 +71,9 @@ pushd Python-${PYTHON_VERSION}
 
 # configure doesn't support cross-compiling on Apple. Teach it.
 if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
-    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
+    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
+        patch -p1 -i ${ROOT}/patch-apple-cross-3.14.patch
+    elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
         patch -p1 -i ${ROOT}/patch-apple-cross-3.13.patch
     elif [ "${PYTHON_MAJMIN_VERSION}" = "3.12" ]; then
         patch -p1 -i ${ROOT}/patch-apple-cross-3.12.patch
diff --git a/cpython-unix/patch-apple-cross-3.14.patch b/cpython-unix/patch-apple-cross-3.14.patch
new file mode 100644
index 00000000..00031d2c
--- /dev/null
+++ b/cpython-unix/patch-apple-cross-3.14.patch
@@ -0,0 +1,65 @@
+diff --git a/configure.ac b/configure.ac
+index 58f54076ff2..a734260691a 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -330,6 +330,21 @@ then
+ 	*-apple-ios*)
+ 		ac_sys_system=iOS
+ 		;;
++	*-apple-ios*)
++		ac_sys_system=iOS
++		;;
++	*-apple-tvos*)
++		ac_sys_system=tvOS
++		;;
++	*-apple-watchos*)
++		ac_sys_system=watchOS
++		;;
++	*-*-darwin*)
++		ac_sys_system=Darwin
++		;;
++	*-apple-*)
++	  ac_sys_system=Darwin
++	  ;;
+ 	*-*-vxworks*)
+ 	    ac_sys_system=VxWorks
+ 	    ;;
+--- a/configure.ac
++++ b/configure.ac
+@@ -771,6 +786,15 @@ if test "$cross_compiling" = yes; then
+ 				;;
+ 		esac
+ 		;;
++  *-*-darwin*)
++		case "$host_cpu" in
++		arm*)
++			_host_ident=arm
++			;;
++		*)
++			_host_ident=$host_cpu
++		esac
++		;;
+ 	*-*-vxworks*)
+ 		_host_ident=$host_cpu
+ 		;;
+@@ -1582,7 +1623,7 @@ if test $enable_shared = "yes"; then
+       BLDLIBRARY='-Wl,+b,$(LIBDIR) -L. -lpython$(LDVERSION)'
+       RUNSHARED=SHLIB_PATH=`pwd`${SHLIB_PATH:+:${SHLIB_PATH}}
+       ;;
+-    Darwin*)
++    Darwin*|iOS*|tvOS*|watchOS*)
+       LDLIBRARY='libpython$(LDVERSION).dylib'
+       BLDLIBRARY='-L. -lpython$(LDVERSION)'
+       RUNSHARED=DYLD_LIBRARY_PATH=`pwd`${DYLD_LIBRARY_PATH:+:${DYLD_LIBRARY_PATH}}
+@@ -3469,6 +3510,11 @@ then
+ 	Linux*|GNU*|QNX*|VxWorks*|Haiku*)
+ 		LDSHARED='$(CC) -shared'
+ 		LDCXXSHARED='$(CXX) -shared';;
++	iOS*|tvOS*|watchOS*)
++		LDSHARED='$(CC) -bundle -undefined dynamic_lookup'
++		LDCXXSHARED='$(CXX) -bundle -undefined dynamic_lookup'
++		BLDSHARED="$LDSHARED"
++		;;
+ 	FreeBSD*)
+ 		if [[ "`$CC -dM -E - </dev/null | grep __ELF__`" != "" ]]
+ 		then
diff --git a/cpython-unix/patch-dont-clear-runshared-14.patch b/cpython-unix/patch-dont-clear-runshared-14.patch
index 9d410349..e0862660 100644
--- a/cpython-unix/patch-dont-clear-runshared-14.patch
+++ b/cpython-unix/patch-dont-clear-runshared-14.patch
@@ -1,15 +1,15 @@
-diff --git a/configure b/configure
-index 57be576e3ca..a87c6eb8f2e 100755
---- a/configure
-+++ b/configure
-@@ -7617,10 +7617,6 @@ fi
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $LDLIBRARY" >&5
- printf "%s\n" "$LDLIBRARY" >&6; }
+diff --git a/configure.ac b/configure.ac
+index bd0221481c5..f2fb52c1efc 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1605,10 +1605,6 @@ else # shared is disabled
+ fi
+ AC_MSG_RESULT([$LDLIBRARY])
  
 -if test "$cross_compiling" = yes; then
 -  RUNSHARED=
 -fi
 -
  # HOSTRUNNER - Program to run CPython for the host platform
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking HOSTRUNNER" >&5
- printf %s "checking HOSTRUNNER... " >&6; }
+ AC_MSG_CHECKING([HOSTRUNNER])
+ if test -z "$HOSTRUNNER"

From e1c604b408a22d57f4c0e5f88279e8f55aef768c Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 13:55:13 -0600
Subject: [PATCH 17/21] Set `LINUX_NO_EXPLICIT_BZERO` for `_blake` separately

---
 cpython-unix/extension-modules.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index f3ace564..d7d3f5a8 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -46,6 +46,9 @@ _blake2:
       minimum-python-version: "3.14"
     - define: _DEFAULT_SOURCE
       minimum-python-version: "3.14"
+    # Disable `explicit_bzero`, it requires glib 2.25+
+    - define: LINUX_NO_EXPLICIT_BZERO
+      minimum-python-version: "3.14"
 
 _bz2:
   sources:

From 9e61d1fb88b15ca0cb5d06a32634c28848913743 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 15:04:36 -0600
Subject: [PATCH 18/21] Update expected macosx target and fix patch

---
 cpython-unix/patch-apple-cross-3.14.patch | 24 +++++++++++++++++++++++
 src/validation.rs                         |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/cpython-unix/patch-apple-cross-3.14.patch b/cpython-unix/patch-apple-cross-3.14.patch
index 00031d2c..20953c4c 100644
--- a/cpython-unix/patch-apple-cross-3.14.patch
+++ b/cpython-unix/patch-apple-cross-3.14.patch
@@ -42,6 +42,30 @@ index 58f54076ff2..a734260691a 100644
  	*-*-vxworks*)
  		_host_ident=$host_cpu
  		;;
+@@ -785,6 +809,23 @@ if test "$cross_compiling" = yes; then
+ 	_PYTHON_HOST_PLATFORM="$MACHDEP${_host_ident:+-$_host_ident}"
+ fi
+
++# The _PYTHON_HOST_PLATFORM environment variable is used to
++# override the platform name in distutils and sysconfig when
++# cross-compiling. On Apple, the platform name expansion logic
++# is non-trivial, including renaming MACHDEP=darwin to macosx
++# and including the deployment target (or current OS version if
++# not set). Here we always force an override based on the target
++# triple. We do this in all build configurations because historically
++# the automatic resolution has been brittle.
++case "$host" in
++aarch64-apple-darwin*)
++  _PYTHON_HOST_PLATFORM="macosx-${MACOSX_DEPLOYMENT_TARGET}-arm64"
++  ;;
++x86_64-apple-darwin*)
++  _PYTHON_HOST_PLATFORM="macosx-${MACOSX_DEPLOYMENT_TARGET}-x86_64"
++  ;;
++esac
++
+ # Some systems cannot stand _XOPEN_SOURCE being defined at all; they
+ # disable features if it is defined, without any means to access these
+ # features as extensions. For these systems, we skip the definition of
 @@ -1582,7 +1623,7 @@ if test $enable_shared = "yes"; then
        BLDLIBRARY='-Wl,+b,$(LIBDIR) -L. -lpython$(LDVERSION)'
        RUNSHARED=SHLIB_PATH=`pwd`${SHLIB_PATH:+:${SHLIB_PATH}}
diff --git a/src/validation.rs b/src/validation.rs
index bbc3ae7b..23f88220 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -489,7 +489,7 @@ static PLATFORM_TAG_BY_TRIPLE: Lazy<HashMap<&'static str, &'static str>> = Lazy:
         ("mips64el-unknown-linux-gnuabi64", "todo"),
         ("ppc64le-unknown-linux-gnu", "linux-powerpc64le"),
         ("s390x-unknown-linux-gnu", "linux-s390x"),
-        ("x86_64-apple-darwin", "macosx-10.9-x86_64"),
+        ("x86_64-apple-darwin", "macosx-10.15-x86_64"),
         ("x86_64-apple-ios", "iOS-x86_64"),
         ("x86_64-pc-windows-msvc", "win-amd64"),
         ("x86_64-unknown-linux-gnu", "linux-x86_64"),

From 5fdcd3d9dfd43ed77d7d1d4d129b7724041181d1 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 16:05:45 -0600
Subject: [PATCH 19/21] Ignore `test_strftime_y2k` when cross-compiling on
 Linux for 3.14+

---
 cpython-unix/build-cpython.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 6345227c..9feb05a0 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -483,6 +483,12 @@ if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}"  ]; then
     CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_explicit_bzero=no"
 fi
 
+# On 3.14+ `test_strftime_y2k` fails when cross-compiling for `x86_64_v2` and `x86_64_v3` targets on
+# Linux, so we ignore it. See https://github.com/python/cpython/issues/128104
+if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" && -n "${CROSS_COMPILING}" && "${PYBUILD_PLATFORM}" != "macos" ]]; then
+    export PROFILE_TASK='-m test --pgo --ignore test_strftime_y2k'
+fi
+
 # We use ndbm on macOS and BerkeleyDB elsewhere.
 if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
     CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --with-dbmliborder=ndbm"

From 2f4fa0304ac918c45203968e427a99b69de54e53 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 16:58:53 -0600
Subject: [PATCH 20/21] =?UTF-8?q?Remove=203.14=20cross-path=20=E2=80=94=20?=
 =?UTF-8?q?it=20matches=203.13?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 cpython-unix/build-cpython.sh             |  4 +-
 cpython-unix/patch-apple-cross-3.14.patch | 89 -----------------------
 2 files changed, 1 insertion(+), 92 deletions(-)
 delete mode 100644 cpython-unix/patch-apple-cross-3.14.patch

diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 9feb05a0..fae8cd31 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -71,9 +71,7 @@ pushd Python-${PYTHON_VERSION}
 
 # configure doesn't support cross-compiling on Apple. Teach it.
 if [ "${PYBUILD_PLATFORM}" = "macos" ]; then
-    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
-        patch -p1 -i ${ROOT}/patch-apple-cross-3.14.patch
-    elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
+    if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
         patch -p1 -i ${ROOT}/patch-apple-cross-3.13.patch
     elif [ "${PYTHON_MAJMIN_VERSION}" = "3.12" ]; then
         patch -p1 -i ${ROOT}/patch-apple-cross-3.12.patch
diff --git a/cpython-unix/patch-apple-cross-3.14.patch b/cpython-unix/patch-apple-cross-3.14.patch
deleted file mode 100644
index 20953c4c..00000000
--- a/cpython-unix/patch-apple-cross-3.14.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 58f54076ff2..a734260691a 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -330,6 +330,21 @@ then
- 	*-apple-ios*)
- 		ac_sys_system=iOS
- 		;;
-+	*-apple-ios*)
-+		ac_sys_system=iOS
-+		;;
-+	*-apple-tvos*)
-+		ac_sys_system=tvOS
-+		;;
-+	*-apple-watchos*)
-+		ac_sys_system=watchOS
-+		;;
-+	*-*-darwin*)
-+		ac_sys_system=Darwin
-+		;;
-+	*-apple-*)
-+	  ac_sys_system=Darwin
-+	  ;;
- 	*-*-vxworks*)
- 	    ac_sys_system=VxWorks
- 	    ;;
---- a/configure.ac
-+++ b/configure.ac
-@@ -771,6 +786,15 @@ if test "$cross_compiling" = yes; then
- 				;;
- 		esac
- 		;;
-+  *-*-darwin*)
-+		case "$host_cpu" in
-+		arm*)
-+			_host_ident=arm
-+			;;
-+		*)
-+			_host_ident=$host_cpu
-+		esac
-+		;;
- 	*-*-vxworks*)
- 		_host_ident=$host_cpu
- 		;;
-@@ -785,6 +809,23 @@ if test "$cross_compiling" = yes; then
- 	_PYTHON_HOST_PLATFORM="$MACHDEP${_host_ident:+-$_host_ident}"
- fi
-
-+# The _PYTHON_HOST_PLATFORM environment variable is used to
-+# override the platform name in distutils and sysconfig when
-+# cross-compiling. On Apple, the platform name expansion logic
-+# is non-trivial, including renaming MACHDEP=darwin to macosx
-+# and including the deployment target (or current OS version if
-+# not set). Here we always force an override based on the target
-+# triple. We do this in all build configurations because historically
-+# the automatic resolution has been brittle.
-+case "$host" in
-+aarch64-apple-darwin*)
-+  _PYTHON_HOST_PLATFORM="macosx-${MACOSX_DEPLOYMENT_TARGET}-arm64"
-+  ;;
-+x86_64-apple-darwin*)
-+  _PYTHON_HOST_PLATFORM="macosx-${MACOSX_DEPLOYMENT_TARGET}-x86_64"
-+  ;;
-+esac
-+
- # Some systems cannot stand _XOPEN_SOURCE being defined at all; they
- # disable features if it is defined, without any means to access these
- # features as extensions. For these systems, we skip the definition of
-@@ -1582,7 +1623,7 @@ if test $enable_shared = "yes"; then
-       BLDLIBRARY='-Wl,+b,$(LIBDIR) -L. -lpython$(LDVERSION)'
-       RUNSHARED=SHLIB_PATH=`pwd`${SHLIB_PATH:+:${SHLIB_PATH}}
-       ;;
--    Darwin*)
-+    Darwin*|iOS*|tvOS*|watchOS*)
-       LDLIBRARY='libpython$(LDVERSION).dylib'
-       BLDLIBRARY='-L. -lpython$(LDVERSION)'
-       RUNSHARED=DYLD_LIBRARY_PATH=`pwd`${DYLD_LIBRARY_PATH:+:${DYLD_LIBRARY_PATH}}
-@@ -3469,6 +3510,11 @@ then
- 	Linux*|GNU*|QNX*|VxWorks*|Haiku*)
- 		LDSHARED='$(CC) -shared'
- 		LDCXXSHARED='$(CXX) -shared';;
-+	iOS*|tvOS*|watchOS*)
-+		LDSHARED='$(CC) -bundle -undefined dynamic_lookup'
-+		LDCXXSHARED='$(CXX) -bundle -undefined dynamic_lookup'
-+		BLDSHARED="$LDSHARED"
-+		;;
- 	FreeBSD*)
- 		if [[ "`$CC -dM -E - </dev/null | grep __ELF__`" != "" ]]
- 		then

From 70550713a8062b974fad6ba110831fadbbd80b2f Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Thu, 19 Dec 2024 18:04:04 -0600
Subject: [PATCH 21/21] Restore `_blake2` to global expected extension modules

---
 src/validation.rs | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/validation.rs b/src/validation.rs
index 23f88220..fa57aec6 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -603,6 +603,7 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
     "_ast",
     "_asyncio",
     "_bisect",
+    "_blake2",
     "_bz2",
     "_codecs",
     "_codecs_cn",
@@ -688,7 +689,6 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_9: &[&str] = &[
     "audioop",
-    "_blake2",
     "_peg_parser",
     "_sha256",
     "_sha512",
@@ -699,7 +699,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_9: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] = &[
     "audioop",
-    "_blake2",
     "_sha256",
     "_sha512",
     "_xxsubinterpreters",
@@ -708,7 +707,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
     "audioop",
-    "_blake2",
     "_sha256",
     "_sha512",
     "_tokenize",
@@ -719,7 +717,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
 
 const GLOBAL_EXTENSIONS_PYTHON_3_12: &[&str] = &[
     "audioop",
-    "_blake2",
     "_sha2",
     "_tokenize",
     "_typing",
@@ -729,7 +726,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_12: &[&str] = &[
 ];
 
 const GLOBAL_EXTENSIONS_PYTHON_3_13: &[&str] = &[
-    "_blake2",
     "_interpchannels",
     "_interpqueues",
     "_interpreters",