feat: Add Python 3.14 support to build and validation

.github/workflows/build.yml

@@ -2,45 +2,65 @@
 on:
   pull_request:
   push:
-    branches: [main, test-me-*]
+    branches: [main]
 
 concurrency:
   # serialize runs on the default branch
   group: ${{ github.event_name == 'push' && github.workflow || github.sha }}${{ github.workflow }}
 
 jobs:
+  image:
+    strategy:
+      matrix:
+        include:
+        - {arch: amd64, os: ubuntu-latest}
+        - {arch: arm64, os: ubuntu-24.04-arm}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      packages: write
+    steps:
+    - uses: actions/checkout@v3
+    - run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< '${{ secrets.GITHUB_TOKEN }}'
+    - run: |
+        docker buildx build \
+            --cache-from ghcr.io/getsentry/pypi-manylinux-${{ matrix.arch }}-ci:latest \
+            --cache-to type=inline \
+            --platform linux/${{ matrix.arch }} \
+            --tag ghcr.io/getsentry/pypi-manylinux-${{ matrix.arch }}-ci:${{ github.sha }} \
+            ${{ github.ref == 'refs/heads/main' && format('--tag ghcr.io/getsentry/pypi-manylinux-{0}-ci:latest', matrix.arch) || '' }} \
+            --push \
+            docker
   linux:
+    needs: [image]
     strategy:
       matrix:
         include:
         - {arch: amd64, os: ubuntu-latest}
         - {arch: arm64, os: ubuntu-24.04-arm}
     runs-on: ${{ matrix.os }}
-    container: ghcr.io/getsentry/pypi-manylinux-${{ matrix.arch }}-ci
+    container: ghcr.io/getsentry/pypi-manylinux-${{ matrix.arch }}-ci:${{ github.sha }}
     steps:
     - uses: actions/checkout@v3
     - run: python3 -um build --pypi-url https://pypi.devinfra.sentry.io
     - run: python3 -um validate --index-url https://pypi.devinfra.sentry.io/simple
     - uses: actions/upload-artifact@v4
       with:
         name: dist-linux-${{ matrix.arch }}
         path: dist/*
   macos:
     strategy:
       matrix:
-        runs-on: [macos-14]
+        runs-on: [macos-15]
     runs-on: ${{ matrix.runs-on }}
     steps:
     - uses: actions/checkout@v3
-    - run: |
-        # work around https://github.com/indygreg/python-build-standalone/issues/208
-        HOMEBREW_NO_AUTO_UPDATE=1 brew install gnu-tar
-        echo "$(brew --prefix gnu-tar)/libexec/gnubin" >> "$GITHUB_PATH"
+    - run: pip install --break-system-packages uv
     - run: python3 -u docker/install-pythons --dest pythons
     - run: |
         echo "$PWD/pythons/cp311-cp311/bin" >> "$GITHUB_PATH"
         echo "$PWD/pythons/cp312-cp312/bin" >> "$GITHUB_PATH"
         echo "$PWD/pythons/cp313-cp313/bin" >> "$GITHUB_PATH"
+        echo "$PWD/pythons/cp314-cp314/bin" >> "$GITHUB_PATH"
         echo "$PWD/venv/bin" >> "$GITHUB_PATH"
     - run: python3 -um venv venv && pip install -r docker/requirements.txt
     - run: python3 -um build --pypi-url https://pypi.devinfra.sentry.io

build.py

@@ -32,7 +32,7 @@
 from packaging.utils import parse_wheel_filename
 from packaging.version import Version
 
-PYTHONS = ((3, 11), (3, 12), (3, 13))
+PYTHONS = ((3, 11), (3, 12), (3, 13), (3, 14))
 
 BINARY_EXTS = frozenset(
     (".c", ".cc", ".cpp", ".cxx", ".pxd", ".pxi", ".pyx", ".go", ".rs")

docker/Dockerfile

@@ -21,8 +21,11 @@ RUN : \
         libncursesw5-dev \
         libreadline-dev \
         libsqlite3-dev \
+        libcurl4-openssl-dev \
+        libsasl2-dev \
         libssl-dev \
         libtool \
+        libzstd-dev \
         make \
         pkg-config \
         uuid-dev \
@@ -31,27 +34,15 @@ RUN : \
         zstd \
     && rm -rf /var/lib/apt/lists/*
 
-# https://github.com/pypa/auditwheel/issues/229
-# libc's libcrypt1 uses GLIBC_PRIVATE so we must build our own
-RUN : \
-    && git clone https://github.com/pypa/manylinux /tmp/manylinux \
-    && cd /tmp/manylinux \
-    && git checkout 075550587bb428c01ed2dd31f9b6e0b089d62802 \
-    && \
-        AUDITWHEEL_POLICY= \
-        LIBXCRYPT_VERSION=4.4.28 \
-        LIBXCRYPT_HASH=db7e37901969cb1d1e8020cb73a991ef81e48e31ea5b76a101862c806426b457 \
-        LIBXCRYPT_DOWNLOAD_URL=https://github.com/besser82/libxcrypt/archive \
-            /tmp/manylinux/docker/build_scripts/install-libxcrypt.sh \
-    && rm -rf /tmp/manylinux
-
 ENV \
     BUILD_IN_CONTAINER=1 \
     PATH=/venv/bin:/opt/python/cp311-cp311/bin:/opt/python/cp312-cp312/bin:/opt/python/cp313-cp313/bin:/opt/python/cp314-cp314/bin:$PATH \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_NO_CACHE_DIR=1 \
     PIP_NO_WARN_ABOUT_ROOT_USER=0
 
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
 COPY install-pythons /tmp/install-pythons
 RUN /tmp/install-pythons
 

docker/install-pythons

@@ -2,61 +2,11 @@
 from __future__ import annotations
 
 import argparse
-import hashlib
-import os.path
-import platform
-import re
-import secrets
+import glob
+import os
 import subprocess
-import sys
-import tempfile
 
-RELEASE = (
-    "https://github.com/indygreg/python-build-standalone/releases/download/20260211/"
-)
-# curl --silent --location https://github.com/indygreg/python-build-standalone/releases/download/20260211/SHA256SUMS | grep -E '(aarch64-apple-darwin-pgo\+lto-full|x86_64-apple-darwin-pgo\+lto-full|aarch64-unknown-linux-gnu-pgo\+lto-full|x86_64-unknown-linux-gnu-pgo\+lto-full)' | grep -Ev '(cpython-3\.(8|9|10|15)|freethreaded)'
-CHECKSUMS = """\
-ceda72c76ecfd4294ae3fdf275202a3cfe912cf1dc7076c9526171aaaedbd3e3  cpython-3.11.14+20260211-aarch64-apple-darwin-pgo+lto-full.tar.zst
-355c4a10233a2e3ac1e511e7cf052116404e197bc70fcc22b67aba635e209808  cpython-3.11.14+20260211-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst
-898995bc172df26f5e0ce9bac316254756094466b9d472234e62e4045e1ddbf6  cpython-3.11.14+20260211-x86_64-apple-darwin-pgo+lto-full.tar.zst
-9dd3129d78fc42a63690b09f9f48b27d35b0fbe7b580fd1cd85bb554c82671b6  cpython-3.11.14+20260211-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst
-bf70a8ba4d44eb243af9dc3485656e0ce3757588eefe27e1801b36ff9773805a  cpython-3.12.12+20260211-aarch64-apple-darwin-pgo+lto-full.tar.zst
-48cccc8970f32586b60125199c955da870c5b9c52c05afb2bce28714eeb17cc6  cpython-3.12.12+20260211-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst
-14fe4f2213f9b89d5649b2c50636be20393ec0092960d1acd11f7c84a4e1b2e9  cpython-3.12.12+20260211-x86_64-apple-darwin-pgo+lto-full.tar.zst
-75428635145d4eb8de86cff5d00a823009a21fe8c173c7899959d0f41f73ad4a  cpython-3.12.12+20260211-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst
-3baef69715ffc554a7f173e9419cfb75ddf25b7cae91ab141032843d53fa34c4  cpython-3.13.12+20260211-aarch64-apple-darwin-pgo+lto-full.tar.zst
-0ad848cab9031fc80c64442698f6eff112d81d45eaf53f49ece6ecbfc97f6ea6  cpython-3.13.12+20260211-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst
-8ad36a0b44b03f2c236d05135600d626ae73245eae0361a17ddabb9e7163e50b  cpython-3.13.12+20260211-x86_64-apple-darwin-pgo+lto-full.tar.zst
-2483028342db1e31a8a4004a859a856fade2563bae97f18812a2d27a123773e6  cpython-3.13.12+20260211-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst
-d016c5a16c6a246f56cf2fae2a4150a339311a30787347ff1c1e063295c82401  cpython-3.14.3+20260211-aarch64-apple-darwin-pgo+lto-full.tar.zst
-13a08dca6f29df3701f1846184db78499d23014f6d5a70fa6c2c1f29baee350a  cpython-3.14.3+20260211-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst
-3e55c3d0914e7e4f2e7a135c80077a0ac635de9dcfa0c08f2544fc2165e264a4  cpython-3.14.3+20260211-x86_64-apple-darwin-pgo+lto-full.tar.zst
-96c6684fffd6da9d219400b2e3c020d9bc2c838cbb4ac202e2dd652dda3d1914  cpython-3.14.3+20260211-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst
-"""
 VERSIONS = ("3.11.14", "3.12.12", "3.13.12", "3.14.3")
-ARCH_MAP = {"arm64": "aarch64"}
-ARCH = ARCH_MAP.get(platform.machine(), platform.machine())
-
-CLANG_PP = re.compile(r"\bclang\+\+")
-CLANG = re.compile(r"\bclang\b")
-
-
-def _must_sub(reg: re.Pattern[str], new: str, s: str) -> str:
-    after = reg.sub(new, s)
-    if after == s:
-        raise AssertionError(f"expected replacement by {reg} => {new}!")
-    return after
-
-
-def _checksum_url(version: str) -> tuple[str, str]:
-    for line in CHECKSUMS.splitlines():
-        sha256, filename = line.split()
-        _, f_version_release, arch, _, plat, *_ = filename.split("-")
-        f_version, _ = f_version_release.split("+")
-        if version == f_version and sys.platform == plat and ARCH == arch:
-            return (sha256, f"{RELEASE}/{filename}")
-    else:
-        raise NotImplementedError(version, sys.platform, platform.machine())
 
 
 def main() -> int:
@@ -66,57 +16,49 @@ def main() -> int:
 
     os.makedirs(args.dest, exist_ok=True)
 
-    for version in VERSIONS:
-        with tempfile.TemporaryDirectory() as tmpdir:
-            expected, url = _checksum_url(version)
-
-            major, minor, *_ = version.split(".")
-            dest = os.path.join(args.dest, f"cp{major}{minor}-cp{major}{minor}")
-            tgz_dest = os.path.join(tmpdir, "python.tgz")
+    subprocess.check_call(
+        ("uv", "python", "install", *VERSIONS, "--install-dir", args.dest),
+    )
 
-            curl_cmd = ("curl", "--silent", "--location", "--output", tgz_dest, url)
-            subprocess.check_call(curl_cmd)
-
-            with open(tgz_dest, "rb") as f:
-                sha256 = hashlib.sha256(f.read()).hexdigest()
-            if not secrets.compare_digest(sha256, expected):
-                raise AssertionError(f"checksum mismatch {sha256=} {expected=}")
-
-            os.makedirs(dest, exist_ok=True)
-            tar_cmd = (
-                "tar",
-                "-C",
-                dest,
-                "--strip-components=2",
-                "-xf",
-                tgz_dest,
-                "python/install",
-            )
-            subprocess.check_call(tar_cmd)
-
-            # https://github.com/indygreg/python-build-standalone/issues/209
-            if sys.platform == "linux" and ARCH == "x86_64":
-                for fname in (
-                    f"{dest}/lib/python{major}.{minor}/config-{major}.{minor}-x86_64-linux-gnu/Makefile",
-                    f"{dest}/lib/python{major}.{minor}/_sysconfigdata__linux_x86_64-linux-gnu.py",
-                ):
-                    print(f"XXX: fixing up build metadata in {fname}")
-                    with open(fname) as f:
-                        contents = f.read()
-                    contents = _must_sub(CLANG_PP, "c++", contents)
-                    contents = _must_sub(CLANG, "cc", contents)
-                    with open(fname, "w") as f:
-                        f.write(contents)
-
-            py = os.path.join(dest, "bin", "python3")
-            subprocess.check_call((py, "-mensurepip"))
-            subprocess.check_call(
-                (
-                    *(py, "-mpip", "install"),
-                    *("pip==25.0.1", "setuptools==75.8.0", "wheel==0.45.1"),
-                )
+    for version in VERSIONS:
+        major, minor, *_ = version.split(".")
+
+        # uv installs to e.g. cpython-3.14.3-linux-aarch64-gnu/
+        matches = glob.glob(os.path.join(args.dest, f"cpython-{major}.{minor}.*"))
+        if len(matches) != 1:
+            raise AssertionError(
+                f"expected exactly one match for cpython-{major}.{minor}.*, "
+                f"got {matches}"
             )
-            subprocess.check_call((py, "--version", "--version"))
+        installed_dir = matches[0]
+
+        # symlink cpXY-cpXY -> the uv-installed directory for PATH compat
+        link = os.path.join(args.dest, f"cp{major}{minor}-cp{major}{minor}")
+        os.symlink(os.path.basename(installed_dir), link)
+
+        # remove PEP 668 marker so pip works normally
+        marker = os.path.join(
+            installed_dir,
+            "lib",
+            f"python{major}.{minor}",
+            "EXTERNALLY-MANAGED",
+        )
+        if os.path.exists(marker):
+            os.remove(marker)
+
+        py = os.path.join(link, "bin", "python3")
+        subprocess.check_call((py, "-mensurepip"))
+        subprocess.check_call(
+            (
+                py,
+                "-mpip",
+                "install",
+                "pip==25.0.1",
+                "setuptools==75.8.0",
+                "wheel==0.45.1",
+            ),
+        )
+        subprocess.check_call((py, "--version", "--version"))
 
     return 0
 

packages.ini

@@ -79,6 +79,7 @@ python_versions = <3.13
 [babel==2.17.0]
 
 [backports-zstd==1.3.0]
+python_versions = <3.14
 
 [backrefs==5.9]
 
@@ -871,8 +872,11 @@ python_versions = <3.13
 [grpcio==1.66.1]
 python_versions = <3.13
 [grpcio==1.67.0]
+python_versions = <3.14
 [grpcio==1.72.0rc1]
+python_versions = <3.14
 [grpcio==1.73.1]
+python_versions = <3.14
 [grpcio==1.75.1]
 
 [grpcio-status==1.47.0]
@@ -1006,7 +1010,9 @@ python_versions = <3.12
 [jinja2==3.1.6]
 
 [jiter==0.9.0]
+python_versions = <3.14
 [jiter==0.10.0]
+python_versions = <3.14
 
 [jmespath==0.10.0]
 [jmespath==1.0.1]
@@ -1072,6 +1078,7 @@ python_versions = <3.13
 [librt==0.7.8]
 
 [lief==0.16.6]
+python_versions = <3.14
 
 [looseversion==1.0.2]
 

prebuild/crc32c

@@ -49,6 +49,7 @@ def main() -> int:
         subprocess.check_call(
             (
                 "cmake",
+                "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
                 f"-DCMAKE_INSTALL_PREFIX={args.prefix}",
                 "-DCRC32C_BUILD_TESTS=no",
                 "-DCRC32C_BUILD_BENCHMARKS=no",

prebuild/librdkafka

@@ -39,20 +39,17 @@ def main() -> int:
                 "./configure",
                 "--enable-static",
                 "--install-deps",
-                "--source-deps-only",
                 f"--prefix={args.prefix}",
             ),
             cwd=tmpdir,
         )
 
         print("building...")
-        subprocess.check_call(("make", "-j"), cwd=tmpdir)
-        print("testing...")
-        subprocess.check_call(
-            ("examples/rdkafka_example", "-X", "builtin.features"), cwd=tmpdir
-        )
+        subprocess.check_call(("make", "-j", "-C", "src"), cwd=tmpdir)
+        subprocess.check_call(("make", "-j", "-C", "src-cpp"), cwd=tmpdir)
         print("installing...")
-        subprocess.check_call(("make", "install"), cwd=tmpdir)
+        subprocess.check_call(("make", "-C", "src", "install"), cwd=tmpdir)
+        subprocess.check_call(("make", "-C", "src-cpp", "install"), cwd=tmpdir)
 
     return 0
 

tests/validate_test.py

@@ -43,24 +43,24 @@ def test_pythons_to_check_no_pythons_raises_error():
 
 def test_pythons_to_check_py2_ignored():
     ret = validate._pythons_to_check(parse_tag("py2.py3-none-any"))
-    assert ret == ("python3.11", "python3.12", "python3.13")
+    assert ret == ("python3.11", "python3.12", "python3.13", "python3.14")
 
 
 def test_pythons_to_check_py3_gives_all():
     ret = validate._pythons_to_check(parse_tag("py3-none-any"))
-    assert ret == ("python3.11", "python3.12", "python3.13")
+    assert ret == ("python3.11", "python3.12", "python3.13", "python3.14")
 
 
 def test_pythons_to_check_abi3():
     tag = "cp37-abi3-manylinux1_x86_64"
     ret = validate._pythons_to_check(parse_tag(tag))
-    assert ret == ("python3.11", "python3.12", "python3.13")
+    assert ret == ("python3.11", "python3.12", "python3.13", "python3.14")
 
 
 def test_pythons_to_check_minimum_abi3():
     tag = "cp312-abi3-manylinux1_x86_64"
     ret = validate._pythons_to_check(parse_tag(tag))
-    assert ret == ("python3.12", "python3.13")
+    assert ret == ("python3.12", "python3.13", "python3.14")
 
 
 def test_pythons_to_check_specific_cpython_tag():
@@ -76,7 +76,7 @@ def test_pythons_to_check_multi_platform_with_musllinux():
     tags = parse_tag("py3-none-any") | parse_tag("py3-none-musllinux_1_2_x86_64")
     ret = validate._pythons_to_check(tags)
     # Should succeed because at least one tag (py3-none-any) is compatible
-    assert ret == ("python3.11", "python3.12", "python3.13")
+    assert ret == ("python3.11", "python3.12", "python3.13", "python3.14")
 
 
 def test_top_imports_record(tmp_path):