_1password-gui: Do the PGP verification with an emphemeral GNUPGHOME

This way a ~/.gnupg directory won't be created if there wasn't already one.
Existing trustdb will not be used.

pkgs/applications/misc/1password-gui/update.sh

@@ -30,8 +30,8 @@ mk_url() {
 }
 
 cleanup() {
-  if [[ -f ${GPG_KEYRING-} ]]; then
-    rm "${GPG_KEYRING}"
+  if [[ -d ${TMP_GNUPGHOME-} ]]; then
+    rm -r "${TMP_GNUPGHOME}"
   fi
 
   if [[ -f ${JSON_HEAP-} ]]; then
@@ -47,8 +47,9 @@ while IFS='=' read -r key value; do
   versions["${key}"]="${value}"
 done < <(jq -r 'to_entries[] | "\(.key)=\(.value)"' versions.json)
 
-GPG_KEYRING=$(mktemp -t 1password.kbx.XXXXXX)
-gpg --no-default-keyring --keyring "${GPG_KEYRING}" \
+TMP_GNUPGHOME=$(mktemp -dt 1password-gui.gnupghome.XXXXXX)
+export GNUPGHOME="${TMP_GNUPGHOME}"
+gpg --no-default-keyring --keyring trustedkeys.kbx \
   --keyserver keyserver.ubuntu.com \
   --receive-keys 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
 
@@ -71,7 +72,7 @@ for channel in stable beta; do
 
       # For some reason 1Password PGP signs only Linux binaries.
       if [[ ${os} == "linux" ]]; then
-         gpgv --keyring "${GPG_KEYRING}" \
+         gpgv \
            $(nix store prefetch-file --json "${url}.sig" | jq -r .storePath) \
            $(jq -r --slurp ".[-1].[].[].storePath" "${JSON_HEAP}")
       fi