From 75db2912324f6909b2f6bca6e5416ffc01bfceb1 Mon Sep 17 00:00:00 2001
From: "Berk D. Demir" <bdd@mindcast.org>
Date: Tue, 18 Mar 2025 18:33:26 -0700
Subject: [PATCH] _1password-gui: Do the PGP verification with an emphemeral
 GNUPGHOME

This way a ~/.gnupg directory won't be created if there wasn't already one.
Existing trustdb will not be used.
---
 pkgs/applications/misc/1password-gui/update.sh | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/misc/1password-gui/update.sh b/pkgs/applications/misc/1password-gui/update.sh
index 9a99b555328e..1d31ef972f76 100755
--- a/pkgs/applications/misc/1password-gui/update.sh
+++ b/pkgs/applications/misc/1password-gui/update.sh
@@ -30,8 +30,8 @@ mk_url() {
 }
 
 cleanup() {
-  if [[ -f ${GPG_KEYRING-} ]]; then
-    rm "${GPG_KEYRING}"
+  if [[ -d ${TMP_GNUPGHOME-} ]]; then
+    rm -r "${TMP_GNUPGHOME}"
   fi
 
   if [[ -f ${JSON_HEAP-} ]]; then
@@ -47,8 +47,9 @@ while IFS='=' read -r key value; do
   versions["${key}"]="${value}"
 done < <(jq -r 'to_entries[] | "\(.key)=\(.value)"' versions.json)
 
-GPG_KEYRING=$(mktemp -t 1password.kbx.XXXXXX)
-gpg --no-default-keyring --keyring "${GPG_KEYRING}" \
+TMP_GNUPGHOME=$(mktemp -dt 1password-gui.gnupghome.XXXXXX)
+export GNUPGHOME="${TMP_GNUPGHOME}"
+gpg --no-default-keyring --keyring trustedkeys.kbx \
   --keyserver keyserver.ubuntu.com \
   --receive-keys 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
 
@@ -71,7 +72,7 @@ for channel in stable beta; do
 
       # For some reason 1Password PGP signs only Linux binaries.
       if [[ ${os} == "linux" ]]; then
-         gpgv --keyring "${GPG_KEYRING}" \
+         gpgv \
            $(nix store prefetch-file --json "${url}.sig" | jq -r .storePath) \
            $(jq -r --slurp ".[-1].[].[].storePath" "${JSON_HEAP}")
       fi