[pull] dev from home-assistant:dev

.strict-typing

@@ -612,6 +612,7 @@ homeassistant.components.yale_smart_alarm.*
 homeassistant.components.yalexs_ble.*
 homeassistant.components.youtube.*
 homeassistant.components.zeroconf.*
+homeassistant.components.zinvolt.*
 homeassistant.components.zodiac.*
 homeassistant.components.zone.*
 homeassistant.components.zwave_js.*

homeassistant/backup_restore.py

@@ -4,7 +4,6 @@
 
 from collections.abc import Iterable
 from dataclasses import dataclass
-import hashlib
 import json
 import logging
 from pathlib import Path
@@ -40,17 +39,6 @@ class RestoreBackupFileContent:
     restore_homeassistant: bool
 
 
-def password_to_key(password: str) -> bytes:
-    """Generate a AES Key from password.
-
-    Matches the implementation in supervisor.backups.utils.password_to_key.
-    """
-    key: bytes = password.encode()
-    for _ in range(100):
-        key = hashlib.sha256(key).digest()
-    return key[:16]
-
-
 def restore_backup_file_content(config_dir: Path) -> RestoreBackupFileContent | None:
     """Return the contents of the restore backup file."""
     instruction_path = config_dir.joinpath(RESTORE_BACKUP_FILE)
@@ -96,15 +84,14 @@ def _extract_backup(
     """Extract the backup file to the config directory."""
     with (
         TemporaryDirectory() as tempdir,
-        securetar.SecureTarFile(
+        securetar.SecureTarArchive(
             restore_content.backup_file_path,
-            gzip=False,
             mode="r",
         ) as ostf,
     ):
-        ostf.extractall(
+        ostf.tar.extractall(
             path=Path(tempdir, "extracted"),
-            members=securetar.secure_path(ostf),
+            members=securetar.secure_path(ostf.tar),
             filter="fully_trusted",
         )
         backup_meta_file = Path(tempdir, "extracted", "backup.json")
@@ -126,10 +113,7 @@ def _extract_backup(
                 f"homeassistant.tar{'.gz' if backup_meta['compressed'] else ''}",
             ),
             gzip=backup_meta["compressed"],
-            key=password_to_key(restore_content.password)
-            if restore_content.password is not None
-            else None,
-            mode="r",
+            password=restore_content.password,
         ) as istf:
             istf.extractall(
                 path=Path(tempdir, "homeassistant"),

homeassistant/components/backup/const.py

@@ -33,3 +33,5 @@
     "home-assistant_v2.db",
     "home-assistant_v2.db-wal",
 ]
+
+SECURETAR_CREATE_VERSION = 2

homeassistant/components/backup/manager.py

@@ -20,13 +20,9 @@
 from typing import IO, TYPE_CHECKING, Any, Protocol, TypedDict, cast
 
 import aiohttp
-from securetar import SecureTarFile, atomic_contents_add
+from securetar import SecureTarArchive, atomic_contents_add
 
-from homeassistant.backup_restore import (
-    RESTORE_BACKUP_FILE,
-    RESTORE_BACKUP_RESULT_FILE,
-    password_to_key,
-)
+from homeassistant.backup_restore import RESTORE_BACKUP_FILE, RESTORE_BACKUP_RESULT_FILE
 from homeassistant.const import __version__ as HAVERSION
 from homeassistant.core import HomeAssistant, callback
 from homeassistant.helpers import (
@@ -60,6 +56,7 @@
     EXCLUDE_DATABASE_FROM_BACKUP,
     EXCLUDE_FROM_BACKUP,
     LOGGER,
+    SECURETAR_CREATE_VERSION,
 )
 from .models import (
     AddonInfo,
@@ -1858,20 +1855,22 @@ def is_excluded_by_filter(path: PurePath) -> bool:
 
             return False
 
-        outer_secure_tarfile = SecureTarFile(
-            tar_file_path, "w", gzip=False, bufsize=BUF_SIZE
-        )
-        with outer_secure_tarfile as outer_secure_tarfile_tarfile:
+        with SecureTarArchive(
+            tar_file_path,
+            "w",
+            bufsize=BUF_SIZE,
+            create_version=SECURETAR_CREATE_VERSION,
+            password=password,
+        ) as outer_secure_tarfile:
             raw_bytes = json_bytes(backup_data)
             fileobj = io.BytesIO(raw_bytes)
             tar_info = tarfile.TarInfo(name="./backup.json")
             tar_info.size = len(raw_bytes)
             tar_info.mtime = int(time.time())
-            outer_secure_tarfile_tarfile.addfile(tar_info, fileobj=fileobj)
-            with outer_secure_tarfile.create_inner_tar(
+            outer_secure_tarfile.tar.addfile(tar_info, fileobj=fileobj)
+            with outer_secure_tarfile.create_tar(
                 "./homeassistant.tar.gz",
                 gzip=True,
-                key=password_to_key(password) if password is not None else None,
             ) as core_tar:
                 atomic_contents_add(
                     tar_file=core_tar,

homeassistant/components/backup/manifest.json

@@ -8,6 +8,6 @@
   "integration_type": "service",
   "iot_class": "calculated",
   "quality_scale": "internal",
-  "requirements": ["cronsim==2.7", "securetar==2025.2.1"],
+  "requirements": ["cronsim==2.7", "securetar==2026.2.0"],
   "single_config_entry": true
 }