net-irc/irker: password handling rework for OpenRC init script

Introduce IRKERD_PASSWORD_FILE and prefer that if set in /etc/conf.d/irkerd,
which passes -P /path/to/password instead of the password itself with
-p password.

If IRKERD_PASSWORD_FILE is unset, stash the value of IRKERD_PASSWORD in
a file to 'upgrade' it and avoid showing the password in the process
table.

Needed a patch to make -P work too.

Thanks to navi for feedback on the idea.

Signed-off-by: Sam James <sam@gentoo.org>

net-irc/irker/files/irker-2.24-password-file-typo.patch

@@ -0,0 +1,26 @@
+https://gitlab.com/esr/irker/-/merge_requests/35
+
+From 765334f1e9663c09d507a589cdd4e8c002c1fafc Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sun, 18 Jan 2026 17:53:39 +0000
+Subject: [PATCH] irkerd: fix typo for -P
+
+---
+ irkerd | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/irkerd b/irkerd
+index f22c343..71f0da0 100755
+--- a/irkerd
++++ b/irkerd
+@@ -1219,7 +1219,7 @@ if __name__ == "__main__":
+         LOG.setLevel(log_level)
+ 
+     if args.password_file:
+-        with args.file as f:
++        with args.password_file as f:
+             # IRC passwords must be at most 128 bytes, and cannot contain a \n
+             args.password = f.read(128).split("\n")[0].strip()
+ 
+-- 
+GitLab

net-irc/irker/files/irkerd.confd-r1

@@ -0,0 +1,23 @@
+# /etc/conf.d/irkerd: config file for /etc/init.d/irkerd
+
+# Nick-Serv login
+# IRKERD_NICK=""
+
+# Nick-Server password (deprecated in favor of IRKERD_PASSWORD_FILE)
+# IRKERD_PASSWORD=""
+
+# Nick-Server password file (preferred)
+# IRKERD_PASSWORD_FILE=""
+
+# Log file, if none syslog is used (facility daemon)
+# IRKERD_LOGFILE=""
+
+# Debug Level (critical, error, warning, info, debug)
+# IRKERD_LOGLEVEL=""
+
+# To run an anonymous irkerd safely. It should not be able to write to anywhere
+# on your system. If the user is undefined or empty, it defaults to "nobody".
+# IRKERD_USER=""
+
+# see man pages for irkerd for valid cmdline options
+# IRKERD_OPTS=""

net-irc/irker/files/irkerd.initd-r1

@@ -0,0 +1,49 @@
+#!/sbin/openrc-run
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+: "${pidfile:=/run/${RC_SVCNAME}.pid}"
+: "${IRKERD_USER:=nobody}"
+
+depend() {
+        use net
+}
+
+start_pre() {
+	# If the user has specified IRKERD_PASSWORD, let's mask it from
+	# the process table by stashing it in a file and using -P ...
+	# instead.
+	if [ -z "${IRKERD_PASSWORD_FILE}" ] && [ -n "${IRKERD_PASSWORD}" ] ; then
+		checkpath -F -m 0700 -o "${IRKERD_USER}" /run/irkerd.pw || return 1
+		printf "%s" "${IRKERD_PASSWORD}" > /run/irkerd.pw || return 1
+	fi
+}
+
+start() (
+	if [ -n "${IRKERD_LOGFILE}" ] ; then
+		checkpath -f \
+			-o "${IRKERD_USER}" \
+			"${IRKERD_LOGFILE}" \
+			|| return 1
+	fi
+
+	set -f
+	set -- ${IRKERD_OPTS}
+	[ -n "${IRKERD_LOGLEVEL}" ] && set -- "$@" -d "${IRKERD_LOGLEVEL}"
+	[ -n "${IRKERD_LOGFILE}"  ] && set -- "$@" -l "${IRKERD_LOGFILE}"
+	[ -n "${IRKERD_NICK}"     ] && set -- "$@" -n "${IRKERD_NICK}"
+	if [ -n "${IRKERD_PASSWORD_FILE}" ] ; then
+		set -- "$@" -P "${IRKERD_PASSWORD_FILE}"
+	elif [ -n "${IRKERD_PASSWORD}" ] ; then
+		set -- "$@" -P "/run/irkerd.pw"
+	fi
+
+        ebegin "Starting ${RC_SVCNAME}"
+        start-stop-daemon --start \
+                --quiet --background \
+                --user "${IRKERD_USER}" \
+                --make-pidfile --pidfile "${pidfile}" \
+                --exec /usr/bin/irkerd \
+                -- "$@" < /dev/null
+        eend $?
+)

net-irc/irker/irker-2.24-r1.ebuild

@@ -0,0 +1,66 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="ssl"
+
+inherit optfeature python-single-r1 systemd
+
+DESCRIPTION="Submission tools for IRC notifications"
+HOMEPAGE="http://www.catb.org/esr/irker/ https://gitlab.com/esr/irker"
+SRC_URI="http://www.catb.org/esr/${PN}/${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~s390 ~sparc ~x86"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+# Dependency notes:
+# NOTE: No pkgconfig dep here because of the systemd sed below
+# NOTE: No need for asciidoc here as it's only used for the
+# 'release' makefile target.
+RDEPEND="${PYTHON_DEPS}"
+BDEPEND="
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/xmlto
+	${PYTHON_DEPS}
+"
+
+DOCS=( NEWS README hacking.adoc security.adoc )
+HTML_DOCS=( irkerd.html irkerhook.html )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.24-password-file-typo.patch
+)
+
+src_prepare() {
+	default
+
+	# Rely on systemd eclass for systemd service install
+	sed -i -e "/^SYSTEMDSYSTEMUNITDIR/d" Makefile || die "sed failed"
+
+	# Prefix support
+	sed -e "s|@EPREFIX@|${EPREFIX}|" "${FILESDIR}"/irkerd.service > "${WORKDIR}"/irkerd.service || die "sed failed"
+}
+
+src_install() {
+	default
+
+	python_doscript "${ED}"/usr/bin/irkerd
+	# Not installed with the default Makefile
+	python_doscript irk irkerhook.py
+
+	newinitd "${FILESDIR}"/irkerd.initd-r1 irkerd
+	newconfd "${FILESDIR}"/irkerd.confd-r1 irkerd
+
+	systemd_dounit "${WORKDIR}"/irkerd.service
+
+	docinto examples
+	dodoc filter-example.py filter-test.py
+}
+
+pkg_postinst() {
+	optfeature "SOCKS5 proxy support" dev-python/pysocks
+}