Finish lab2 submission

.github/pull_request_template.md

@@ -0,0 +1,13 @@
+## Goal
+<!-- What does this PR accomplish? 1 sentence. -->
+
+## Changes
+- 
+
+## Testing
+<!-- How did you verify it? -->
+
+## Checklist
+- [ ] Title is a clear sentence (≤ 70 chars)
+- [ ] Commits are signed (`git log --show-signature`)
+- [ ] `submissions/labN.md` updated

labs/lab11.md

@@ -36,6 +36,7 @@ By the end:
 - Read [Reading 11](../lectures/reading11.md)
 - Install Nix with Flakes enabled:
   - [Determinate Nix Installer](https://determinate.systems/posts/determinate-nix-installer/) (recommended)
+  - If `install.determinate.systems` is unreachable or times out from your network, use the [official installer](https://nixos.org/download/) (`sh <(curl -L https://nixos.org/nix/install) --daemon`) — it is served from a different CDN. Enable flakes afterwards: add `experimental-features = nix-command flakes` to `~/.config/nix/nix.conf`
 - ≥ 8 GB free disk
 - A second machine, fresh Docker container (`docker run -it nixos/nix bash`), or a colleague — for verifying reproducibility
 
@@ -47,7 +48,7 @@ By the end:
 
 Your `flake.nix` at the **repo root** MUST:
 
-1. Pin **nixpkgs** to a specific channel revision in `inputs:` (e.g. `nixos-24.11`)
+1. Pin **nixpkgs** to a specific channel revision in `inputs:` (e.g. `nixos-25.11`) — note that `app/go.mod` requires **Go ≥ 1.24**, so the channel's default `buildGoModule` must ship at least that (see Common Pitfalls)
 2. Expose a package `quicknotes` (and `default`) that **builds the QuickNotes Go source from `app/`**
 3. Use `buildGoModule` (or `buildGoApplication`, etc. — your choice; document why)
 4. Set **`CGO_ENABLED = 0`** so the binary is static
@@ -248,6 +249,8 @@ In `submissions/lab11.md`:
 - 🪤 **Different hashes on two machines** — usually means `flake.lock` is not committed. The lockfile pins nixpkgs to a specific revision
 - 🪤 **Out of disk** — Nix store grows. `nix store gc` reclaims unreferenced paths
 - 🪤 **`nix build` requires internet on first run** — downloads pre-built artifacts from cache.nixos.org. Subsequent builds are mostly local
+- 🪤 **`go.mod requires go >= 1.24` from `buildGoModule`** — your pinned nixpkgs ships an older default Go (e.g. `nixos-24.11` → Go 1.23). Fix it **in the flake**: pin `nixos-25.11` or newer, or use `buildGo124Module` / `buildGoModule.override { go = pkgs.go_1_24; }`. Don't downgrade `app/go.mod` — the app source is not yours to edit
+- 🪤 **Installer or build times out on `install.determinate.systems`** — the host may be unreachable from your network even when a plain `curl -I` returns 200. Check from the *same terminal* where you run nix (a browser VPN does not cover WSL2 traffic): `curl -I https://install.determinate.systems` vs `curl -I https://cache.nixos.org/nix-cache-info`. Fall back to the official nixos.org installer (different CDN); builds themselves only need cache.nixos.org and github.com. If cache.nixos.org is also blocked, use a mirror substituter: `--option substituters "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"`
 - 🪤 **WSL2 multi-user Nix is finicky** — use the Determinate installer; or single-user on WSL2
 
 ---

lectures/reading11.md

@@ -94,7 +94,7 @@ Flakes (Nix 2.4+, standard since ~2024) lock **all** external dependencies — i
 # flake.nix
 {
   description = "QuickNotes — DevOps-Intro project";
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
 
   outputs = { self, nixpkgs }:
     let pkgs = nixpkgs.legacyPackages.x86_64-linux;

submissions/lab1.md

@@ -0,0 +1,90 @@
+# Lab 1 submission
+
+## Task 1 - SSH Commit Signing & First Signed Commit
+
+Output of `curl` against endpoints:
+- `/health`(After the POST)
+```cli
+curl -s http://localhost:8080/health | python3 -m json.tool
+{
+    "notes": 5,
+    "status": "ok"
+}
+```
+
+- `/notes`
+```cli
+curl -s http://localhost:8080/notes  | python3 -m json.tool
+[
+    {
+        "id": 3,
+        "title": "DevOps mantra",
+        "body": "If it hurts, do it more often.",
+        "created_at": "2026-01-15T10:10:00Z"
+    },
+    {
+        "id": 4,
+        "title": "Endpoint cheat-sheet",
+        "body": "GET /notes  GET /notes/{id}  POST /notes  DELETE /notes/{id}  GET /health  GET /metrics",
+        "created_at": "2026-01-15T10:15:00Z"
+    },
+    {
+        "id": 5,
+        "title": "hello",
+        "body": "first POST",
+        "created_at": "2026-06-28T14:41:07.521812343Z"
+    },
+    {
+        "id": 1,
+        "title": "Welcome to QuickNotes",
+        "body": "This is the project you'll containerize, deploy, monitor, and harden across all 10 labs.",
+        "created_at": "2026-01-15T10:00:00Z"
+    },
+    {
+        "id": 2,
+        "title": "Read app/main.go first",
+        "body": "Start by understanding the entry point \u2014 env vars, signal handling, graceful shutdown.",
+        "created_at": "2026-01-15T10:05:00Z"
+    }
+]
+```
+
+- `POST /notes`: (2nd POST, 6th note)
+```cli
+curl -s -X POST http://localhost:8080/notes \
+  -H 'Content-Type: application/json' \
+  -d '{"title":"Hello 2","body":"Second POST"}'
+{"id":6,"title":"Hello 2","body":"Second POST","created_at":"2026-06-28T19:25:08.30887237Z"}
+```
+
+Output of `git log --show-signature -1` showing **Good** signature:
+```cli
+commit 428851b08a00f73934802bca69c2488d5b920242 (HEAD -> feature/lab1, origin/feature/lab1)
+Good "git" signature for ahmadhasansarhana@gmail.com with RSA key SHA256:E3jxNqQOmWqV0tyNbDOrEN0PDgkqcYP0I8qC0Lf7GLE
+Author: Ahmad Sarhan <ahmadhasansarhana@gmail.com>
+Date:   Sun Jun 28 17:56:22 2026 +0300
+
+    docs(lab1): start submission
+
+    Signed-off-by: Ahmad Sarhan <ahmadhasansarhana@gmail.com>
+```
+
+
+A Screenshot of Verified  badge on your platform's PR/commit page
+![verified-badge](../screenshots/verfied_badge.png)
+
+
+Why signed commits matter?
+Signed commits matter because they give maintainers and users a cryptographic way to verify who authored or approved a change, instead of trusting only a username, email or repository access. In the XZ Utils backdoor case, malicious code was able to enter the release process after trust in a maintainer identity had been built over time, showing that software supply-chain attacks often target trust itself. Commit signing is not a complete defense, but it raises the bar by making suspicious, unsigned, or unexpectedly signed changes easier to detect before they become part of critical software.
+
+
+## Task 2 - Pull Request Template & First PR 
+
+Added a `.github/pull_request_template.md` 
+
+
+## Task 3 - GitHub Community Engagement
+
+Starring repositories matters in open source because it shows support, helps useful projects gain visibility.
+
+Following developers helps to learn from their work, stay connected, and build professional relationships that support growth.