Purchased or homegrown? Most likely, they obtained one through their cooperation with NK. Given their previous ties to the AQ Khan network, Pakistan cannot be ruled out.
Operation Merlin gave them the warhead blueprints. All they need now is the raw material to manufacture their own.
That’s the thing, the Iranians can’t use a purchased
bomb as an example of their own because the signature
would be of whoever made it.
Once they have their own, then that first one is
just another in their arsenal.