SecureTar is a Python library designed for handling encrypted tarfile backups. It acts as a streaming wrapper around Python's standard `tarfile` module, providing robust encryption capabilities. The library is actively maintained with frequent updates, often introducing significant breaking changes related to its file format and API, notably driven by advancements in cryptographic standards and its use in projects like Home Assistant.
pip install securetarVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to create an encrypted tar archive using `SecureTarFile` and add a file to it using `atomic_contents_add`. It then shows how to open and extract content from the created secure archive, requiring the correct password.
Ensure your application is updated to handle the new file format and cryptographic primitives. Old backups remain readable, but new ones will use the v3 format. Consult the release notes for detailed migration steps.
Adopt the library's internal key derivation mechanisms. Review your code for custom key derivation and update to use `SecureTarFile`'s integrated password handling.
Be aware that backups created with 2025.1.3+ cannot be read by older versions of `securetar`. Plan upgrades carefully to maintain compatibility with your backup/restore processes. Old formats can still be read by newer versions of the library.
Upgrade your Python environment to 3.11 or newer if you are using `securetar` versions 2025.12.0 or later.
Ensure you are using the latest `securetar` version (2026.2.0+) for the most robust and secure backup handling. Regenerate existing encryption keys if you suspect past issues.
Verify the password is correct. Ensure the `securetar` library version used for decryption is compatible with the version used for encryption. If using custom scripts, update them to reflect the latest `securetar` API and file format changes.
Always use the `securetar` Python library itself for decrypting and extracting contents from a `securetar` archive. Standard archive tools will not recognize the encrypted stream as a valid archive before decryption.
Review the API changes in `securetar` versions 2025.12.0 and later. Ensure your application uses the `SecureTarFile` class directly with the password parameter, allowing the library to handle key derivation internally according to the current format specification.