podman run -it --rm --privileged \
  registry.fedoraproject.org/fedora:43 \
  /bin/bash -c '
    set -e
    
    echo; echo "------ Create test script ------"; echo
    
    cat << \EODRIVERSH > /tmp/proof.sh
#!/usr/bin/env bash
set -e 

pushd $(pwd) > /dev/null

trap "popd > /dev/null" EXIT

# Podman secret name
PODMAN_SECRET_NAME="${1:-driver_pass_test}"

# GPG key ID used by `pass`
GPG_KEY_EMAIL="local@local.secret"
## Name for the new key if the ID does not exist
GPG_KEY_NAME="Podman Secret"

# Configure `gpg`: GPG key directory (will be created if it does not exist)
GNUPGDIR="$(pwd)/.gnupg-podman"

# Configure `pass`:
## `pass` storage directory (sub-dir "podman"). (will be created if it does not exist)
PASSWORD_STORE_DIR="$(pwd)/.password-store-podman/podman"
## `gpg` options used by `pass` when getting keys
PASSWORD_STORE_GPG_OPTS="--homedir $GNUPGDIR"

# Export for `pass` usage
export PASSWORD_STORE_DIR
export PASSWORD_STORE_GPG_OPTS

# gpg wrapper with --homedir
gpg() {
  command gpg --homedir "$GNUPGDIR" "$@"
}

# Create example credentials file
cat << \EOF > "$(pwd)/cred-example.json"
{
  "id": 1,
  "pass": "secret_pass"
}
EOF

# Ensure the GPG key exists (create if necessary)
if ! gpg --list-keys "$GPG_KEY_EMAIL" &>/dev/null; then
  mkdir -m 700 "$GNUPGDIR"
  # These options set a blank password and inhibit the prompt: --batch --yes --pinentry-mode loopback --passphrase ""
  if gpg --batch --yes --pinentry-mode loopback --passphrase "" --quick-gen-key "$GPG_KEY_NAME <$GPG_KEY_EMAIL>"; then
    echo "Key successfully created in $GNUPGDIR"
  fi
else
  echo "Key already exists for $GPG_KEY_EMAIL in $GNUPGDIR"
fi

# Ensure `pass` storage exists
if ! pass ls &> /dev/null; then
  # The PASSWORD_STORE_DIR directory will be created if it does not exist
  # Initialize the `pass` storage, assigning a "gpg-id" to a specific "podman" sub-storage
  pass init "$GPG_KEY_EMAIL" 2> /dev/null
fi

# Create a podman secret protected by `pass` (--driver=pass) from the credentials file.
# The `pass` driver considers the GNUPGDIR and PASSWORD_STORE_DIR settings for the GPG_KEY_EMAIL key
podman secret create --replace --driver=pass \
  "--driver-opts=root=$PASSWORD_STORE_DIR" \
  "--driver-opts=gpghomedir=$GNUPGDIR" \
  "--driver-opts=key=$GPG_KEY_EMAIL" \
  "$PODMAN_SECRET_NAME" /tmp/cred-example.json

# End of script

EODRIVERSH
    [[ $? -eq 0 ]] && echo "Script created: /tmp/proof.sh"
    chmod +x /tmp/proof.sh && echo "Script executable: /tmp/proof.sh"
    
    
    
    #  --- LOGS ---
    
    GREEN="\033[0;32m"
    RED="\033[0;31m"
    NC="\033[0m" # No Color  
    log_success() { echo -e "${GREEN}[PASS]${NC} $1"; }
    log_error() { echo -e "${RED}[FAIL]${NC} $1";  }
    
    echo; echo "----- Container Installs and environment config-----"; echo
    echo "Installs: podman pass gnupg2 pinentry"
    
    dnf install -y podman pass gnupg2 pinentry
    
    # Use "vfs" for improved compatibility with podman-in-podman.
    sudo tee /etc/containers/storage.conf > /dev/null << \EOVFS
[storage]
driver = "vfs"
EOVFS
    
    podman system reset -f
    
    echo; echo "------ Prepare Tests ------"; echo
    
    cd /tmp
    
    # create secret with driver=pass from non default gpg and pass root directories
    ./proof.sh "secret-1" > /dev/null
    
    # create secret with driver=pass from non default gpg and pass root directories
    ./proof.sh "secret-2" > /dev/null
    
    
    echo; echo ".......... Tests ..........."; echo
    
    podman secret exists "secret-1"           && log_success "Secret exists: secret-1" || log_error "Secret not exists: secret-1 "
    podman secret rm "secret-1" &> /dev/null  && log_success "Can remove secret: secret-1" || log_error "Can not remove secret: secret-1"
    ! podman secret exists "secret-1"         && log_success "Secret no more exists: secret-1" || log_error "Secret still exists: secret-1"
    
    podman secret exists "secret-2"             && log_success "Secret exists: secret-2 " ||  log_error "Secret not exists: secret-2 "
    rm -rf /tmp/.gnu* /tmp/.pass* > /dev/null   && log_success "Success to remove: /tmp/.gnu* /tmp/.pass*" || log_error "Fail to remove: /tmp/.gnu* /tmp/.pass*"
    podman secret rm "secret-2" &> /dev/null    && log_success "Can remove secret: secret-2" || log_error "Can not remove secret: secret-2"
    ! podman secret exists "secret-2"           && log_success "Secret no more exists: secret-2 " || log_error "Secret still exists: secret-2 "

    # Interactive 
    /bin/bash
'