firefox-bin: Add gpg verification to updater (#22270)

pkgs/applications/networking/browsers/firefox-bin/update.nix

@@ -5,8 +5,9 @@
 , gnused
 , gnugrep
 , curl
+, gnupg
 , baseName ? "firefox"
-, basePath ? "pkgs/applications/networking/browsers/firefox-bin" 
+, basePath ? "pkgs/applications/networking/browsers/firefox-bin"
 , baseUrl ? "http://archive.mozilla.org/pub/firefox/releases/"
 }:
 
@@ -14,10 +15,13 @@ let
   version = (builtins.parseDrvName name).version;
   isBeta = builtins.stringLength version + 1 == builtins.stringLength (builtins.replaceStrings ["b"] ["bb"] version);
 in writeScript "update-${baseName}-bin" ''
-  PATH=${coreutils}/bin:${gnused}/bin:${gnugrep}/bin:${xidel}/bin:${curl}/bin
-
+  PATH=${coreutils}/bin:${gnused}/bin:${gnugrep}/bin:${xidel}/bin:${curl}/bin:${gnupg}/bin
+  set -eux
   pushd ${basePath}
 
+  HOME=`mktemp -d`
+  cat ${./firefox.key} | gpg2 --import
+
   tmpfile=`mktemp`
   url=${baseUrl}
 
@@ -39,8 +43,12 @@ in writeScript "update-${baseName}-bin" ''
            grep -e "${if isBeta then "b" else ""}\([[:digit:]]\|[[:digit:]][[:digit:]]\)$" | ${if isBeta then "" else "grep -v \"b\" |"} \
            tail -1`
 
+  curl --silent -o $HOME/shasums "$url$version/SHA512SUMS"
+  curl --silent -o $HOME/shasums.asc "$url$version/SHA512SUMS.asc"
+  gpgv2 --keyring=$HOME/.gnupg/pubring.kbx $HOME/shasums.asc $HOME/shasums
+
   # this is a list of sha512 and tarballs for both arches
-  shasums=`curl --silent $url$version/SHA512SUMS`
+  shasums=`cat $HOME/shasums`
 
   cat > $tmpfile <<EOF
   {