[14:13:08Z] evidence directory: evidence/verify-20260911T141308Z
[14:13:08Z] created internal network drone-e2e (10.89.231.0/24): internal=true
[14:13:08Z] starting Gitea (docker.io/gitea/gitea:1.22) at 10.89.231.10:3000
[14:13:10Z] Gitea ready; OAuth2 application created (client_id 8f4bdb0d…)
[14:13:10Z] starting Drone server docker.io/drone/drone:2.24.0 at 10.89.231.11:80
[14:13:11Z] Drone server healthy
[14:13:11Z] starting Drone runner docker.io/drone/drone-runner-docker:1.8.5 (podman socket)
[14:13:11Z] runner connected: polling the remote server
[14:13:11Z] confirmed: Drone server container cannot reach https://github.com
[14:13:11Z] logged in to Gitea
[14:13:11Z] OAuth grant accepted; Drone session established
[14:13:11Z] Drone API user: drone-e2e-admin (admin=True)
[14:13:11Z] created Gitea repositories (demo-vulnerable is private: exercises netrc clone auth)
[14:13:11Z] activated repos in Drone; Gitea webhook -> http://10.89.231.11/hook
[14:13:18Z] pushed demo-vulnerable
[14:13:18Z] pushed demo-clean
[14:13:23Z] demo-vulnerable: build #1 running
[14:13:38Z] demo-vulnerable: build #1 failure
[14:13:38Z] demo-clean: build #1 success
[14:13:38Z] assertions: demo-vulnerable
[14:13:38Z]   ok   build status is failure (blocked by the gate)
[14:13:38Z]   ok   step clone succeeded
[14:13:38Z]   ok   step scanner-data succeeded
[14:13:38Z]   ok   step sbom-syft succeeded
[14:13:38Z]   ok   step grype succeeded
[14:13:38Z]   ok   step trivy-fs succeeded
[14:13:38Z]   ok   step trivy-image succeeded
[14:13:38Z]   ok   step evidence succeeded
[14:13:38Z]   ok   step security-gate failed
[14:13:38Z]   ok   gate printed SECURITY GATE: FAIL
[14:13:38Z]   ok   gate blocks on Grype (SBOM) findings
[14:13:38Z]   ok   gate blocks on Trivy filesystem findings
[14:13:38Z]   ok   gate blocks on the synthetic secret
[14:13:38Z]   ok   gate blocks on the Dockerfile misconfiguration
[14:13:38Z]   ok   Django vulnerabilities reported
[14:13:38Z]   ok   Syft produced an SBOM
[14:13:38Z]   ok   image archive scanned by Syft/Grype and Trivy (dist/image.tar)
[14:13:38Z]   ok   DB age check passed
[14:13:38Z]   ok   evidence archive created
[14:13:38Z] assertions: demo-clean
[14:13:38Z]   ok   build status is success
[14:13:38Z]   ok   gate printed SECURITY GATE: PASS
[14:13:38Z]   ok   image step skipped without dist/image.tar
[14:13:38Z]   ok   no step attempted Internet access (black-hole proxy never used)
[14:13:38Z] ALL ASSERTIONS PASSED
[14:13:38Z] PASS: Drone 2.24.0 + runner 1.8.5 + localhost/devsecops/drone-scanners:20260911 verified end-to-end on an internal network