dunno how to attach a patch here... trying to copy it verbatim

reproducer

In T3279#101923, @werner wrote:

I have changed gpg-agent to make --no-grab the default. The new option --grab can be used to revert this.

The only messing I want to do is to a) not tamper with the user's homedir and b)
not leak any files after I'm done.

For a) a homedir sounds fine. But then I can't use the user's secret keys to
sign other keys.
For b) I tried to rely on existing infrastructure to make my life easier. I
expected it to work because it did for the primary keyring. But GnuPG behaves
inconsistently regarding the primary keyring and the trustdb file. Even more
so, because running gpg a second time just appears to work. That makes gpg not
intuitive to use, I think.

And this is, I guess, the main issue I'm seeing.

Why do you include openssl and other stuff with -I ?

I don't do that on purpose. I guess it's the build system, that does that.