From f8d3443f3096ed345508629110a0576d3b42e5d7 Mon Sep 17 00:00:00 2001
From: Stefan Agner <stefan@agner.ch>
Date: Wed, 11 Mar 2026 18:50:24 +0100
Subject: [PATCH] Use securetar v3 for backups when Core is 2026.3.0 or newer
 (#6621)

Core supports SecureTar v3 since 2026.3.0, so use the new version only
then to ensure compatibility. Fall back to v2 for older Core versions.
---
 supervisor/backups/backup.py | 23 ++++++++++++++++++++---
 supervisor/backups/const.py  |  4 ++++
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/supervisor/backups/backup.py b/supervisor/backups/backup.py
index e5b065816..d03f28c9f 100644
--- a/supervisor/backups/backup.py
+++ b/supervisor/backups/backup.py
@@ -58,14 +58,22 @@ from ..exceptions import (
     BackupInvalidError,
     BackupPermissionError,
 )
+from ..homeassistant.const import LANDINGPAGE
 from ..jobs.const import JOB_GROUP_BACKUP
 from ..jobs.decorator import Job
 from ..jobs.job_group import JobGroup
-from ..utils import remove_folder
+from ..utils import remove_folder, version_is_new_enough
 from ..utils.dt import parse_datetime, utcnow
 from ..utils.json import json_bytes
 from ..utils.sentinel import DEFAULT
-from .const import BUF_SIZE, LOCATION_CLOUD_BACKUP, SECURETAR_CREATE_VERSION, BackupType
+from .const import (
+    BUF_SIZE,
+    CORE_SECURETAR_V3_MIN_VERSION,
+    LOCATION_CLOUD_BACKUP,
+    SECURETAR_CREATE_VERSION,
+    SECURETAR_V3_CREATE_VERSION,
+    BackupType,
+)
 from .validate import SCHEMA_BACKUP
 
 IGNORED_COMPARISON_FIELDS = {ATTR_PROTECTED, ATTR_CRYPTO, ATTR_DOCKER}
@@ -444,6 +452,15 @@ class Backup(JobGroup):
     @asynccontextmanager
     async def create(self) -> AsyncGenerator[None]:
         """Create new backup file."""
+        core_version = self.sys_homeassistant.version
+        if (
+            core_version is not None
+            and core_version != LANDINGPAGE
+            and version_is_new_enough(core_version, CORE_SECURETAR_V3_MIN_VERSION)
+        ):
+            securetar_version = SECURETAR_V3_CREATE_VERSION
+        else:
+            securetar_version = SECURETAR_CREATE_VERSION
 
         def _open_outer_tarfile() -> SecureTarArchive:
             """Create and open outer tarfile."""
@@ -457,7 +474,7 @@ class Backup(JobGroup):
                 self.tarfile,
                 "w",
                 bufsize=BUF_SIZE,
-                create_version=SECURETAR_CREATE_VERSION,
+                create_version=securetar_version,
                 password=self._password,
             )
             try:
diff --git a/supervisor/backups/const.py b/supervisor/backups/const.py
index a55c6d240..fe7faa728 100644
--- a/supervisor/backups/const.py
+++ b/supervisor/backups/const.py
@@ -3,10 +3,14 @@
 from enum import StrEnum
 from typing import Literal
 
+from awesomeversion import AwesomeVersion
+
 from ..mounts.mount import Mount
 
 BUF_SIZE = 2**20 * 4  # 4MB
 SECURETAR_CREATE_VERSION = 2
+SECURETAR_V3_CREATE_VERSION = 3
+CORE_SECURETAR_V3_MIN_VERSION: AwesomeVersion = AwesomeVersion("2026.3.0")
 DEFAULT_FREEZE_TIMEOUT = 600
 LOCATION_CLOUD_BACKUP = ".cloud_backup"