Avoiding problems with gpg-agent when running from scripts - gpg2

Question

I'm trying to use gpg to --clearsign a file (for debian packaging purposes) from a script.

I have an exported password-less private-key.gpg file and want to:

gpg --clearsign -o output input

I don't want to mess with the current user's ~/.gnupg or /run/user/$(id -u)/gnupg because they have nothing to do with my script. Also, the script could be running in multiple instances simultaneously and I don't want them interfering with one another.

I thought that would be easy. Setup $GNUPGHOME to a temp dir and be done with it. But I cannot figure out how to get gpg to run in a script without messing with the user's standard configuration at all. It seems gpg has gone to great lengths to make it impossible to avoid the gpg-agent and gpg-agent insists on using global/hard-coded paths.

Can I keep everything under $GNUPGHOME? Or how do I safely use gpg from a shell script without influencing the user's config or use of gpg or other instances of my script?

Details

Reading the gpg docs I see that:

--use-agent
--no-use-agent

    This is dummy option. gpg always requires the agent.

And gpg-agent docs say:

--use-standard-socket
--no-use-standard-socket
--use-standard-socket-p

    Since GnuPG 2.1 the standard socket is always used.
    These options have no more effect. The command gpg-agent
    --use-standard-socket-p will thus always return success.

This "standard socket" is presumably in /run/user/$(id -u)/gnupg - so it seems I can't avoid gpg messing with the user's "normal" use of gpg.

Versions: gpg 2.1.18 on Debian 9 / stretch / stable

Answer 1

If you can't stop gpg from creating files, would it help to give gpg a place to put them that's unique to the current process?

# Create a temporary directory for gpg.
dir="$(mktemp -d)"

# Remove the directory and its contents when the script exits.
trap '[[ ! -d "${dir}" ]] || rm -r "${dir}"' EXIT

# Put your private-key.gpg in the temporary directory.
$(your command here)

# Tell gpg to use the temporary directory.
gpg --homedir "${dir}" --clearsign -o output input