chore: import upstream snapshot with attribution

scripts/Dockerfile

@@ -0,0 +1,56 @@
+FROM --platform=$BUILDPLATFORM golang:1.26.2-alpine AS backend
+WORKDIR /backend-build
+
+# Install build dependencies
+RUN apk add --no-cache git ca-certificates
+
+# Copy go mod files and download dependencies (cached layer)
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+
+# Copy source code (use .dockerignore to exclude unnecessary files)
+COPY . .
+
+# Please build frontend first, so that the static files are available.
+# Refer to `pnpm release` in package.json for the build command.
+ARG TARGETOS TARGETARCH VERSION=dev COMMIT=unknown
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+    go build \
+      -trimpath \
+      -ldflags="-s -w -X github.com/usememos/memos/internal/version.Version=${VERSION} -X github.com/usememos/memos/internal/version.Commit=${COMMIT} -extldflags '-static'" \
+      -tags netgo,osusergo \
+      -o memos \
+      ./cmd/memos
+
+# Use minimal Alpine with security updates
+FROM alpine:3.21 AS monolithic
+
+# Install runtime dependencies and create non-root user in single layer
+RUN apk add --no-cache tzdata ca-certificates su-exec && \
+    addgroup -g 10001 -S nonroot && \
+    adduser -u 10001 -S -G nonroot -h /var/opt/memos nonroot && \
+    mkdir -p /var/opt/memos /usr/local/memos && \
+    chown -R nonroot:nonroot /var/opt/memos
+
+# Copy binary and entrypoint to /usr/local/memos
+COPY --from=backend /backend-build/memos /usr/local/memos/memos
+COPY --from=backend --chmod=755 /backend-build/scripts/entrypoint.sh /usr/local/memos/entrypoint.sh
+
+# Run as root to fix permissions, entrypoint will drop to nonroot
+USER root
+
+# Set working directory to the writable volume
+WORKDIR /var/opt/memos
+
+# Data directory
+VOLUME /var/opt/memos
+
+ENV TZ="UTC" \
+    MEMOS_PORT="5230"
+
+EXPOSE 5230
+
+ENTRYPOINT ["/usr/local/memos/entrypoint.sh", "/usr/local/memos/memos"]

scripts/build.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+
+set -e
+
+# Change to repo root
+cd "$(dirname "$0")/../"
+
+OS=$(uname -s)
+
+# Determine output binary name
+case "$OS" in
+  *CYGWIN*|*MINGW*|*MSYS*)
+    OUTPUT="./build/memos.exe"
+    ;;
+  *)
+    OUTPUT="./build/memos"
+    ;;
+esac
+
+echo "Building for $OS..."
+
+# Ensure build directories exist and configure a writable Go build cache
+mkdir -p ./build/.gocache ./build/.gomodcache
+export GOCACHE="$(pwd)/build/.gocache"
+export GOMODCACHE="$(pwd)/build/.gomodcache"
+
+# Build the executable
+go build -o "$OUTPUT" ./cmd/memos
+
+echo "Build successful!"
+echo "To run the application, execute the following command:"
+echo "$OUTPUT"

scripts/compose.yaml

@@ -0,0 +1,8 @@
+services:
+  memos:
+    image: neosmemo/memos:stable
+    container_name: memos
+    volumes:
+      - ~/.memos/:/var/opt/memos
+    ports:
+      - 5230:5230

scripts/entrypoint.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env sh
+
+# Fix ownership of the data directory (e.g. for users upgrading from older
+# versions where files were created as root) and drop to a non-root user.
+MEMOS_UID=${MEMOS_UID:-10001}
+MEMOS_GID=${MEMOS_GID:-10001}
+DATA_DIR="/var/opt/memos"
+
+# MEMOS_ENTRYPOINT_SWITCHED marks that the privilege drop below has already run.
+# su-exec preserves the environment, so the marker survives the re-exec. Without
+# it, a target of UID 0 (e.g. MEMOS_UID=0, common under rootless Docker) would
+# stay root after su-exec, re-enter this block, and loop forever.
+if [ "$(id -u)" = "0" ] && [ -z "${MEMOS_ENTRYPOINT_SWITCHED:-}" ]; then
+    # Started as root: fix permissions, then re-exec as the target user.
+    if [ -d "$DATA_DIR" ]; then
+        chown -R "$MEMOS_UID:$MEMOS_GID" "$DATA_DIR" 2>/dev/null || true
+    fi
+    echo "memos: starting as UID:GID ${MEMOS_UID}:${MEMOS_GID}"
+    export MEMOS_ENTRYPOINT_SWITCHED=1
+    exec su-exec "$MEMOS_UID:$MEMOS_GID" "$0" "$@"
+fi
+unset MEMOS_ENTRYPOINT_SWITCHED
+
+file_env() {
+   var="$1"
+   fileVar="${var}_FILE"
+
+   val_var="$(printenv "$var")"
+   val_fileVar="$(printenv "$fileVar")"
+
+   if [ -n "$val_var" ] && [ -n "$val_fileVar" ]; then
+      echo "error: both $var and $fileVar are set (but are exclusive)" >&2
+      exit 1
+   fi
+
+   if [ -n "$val_var" ]; then
+      val="$val_var"
+   elif [ -n "$val_fileVar" ]; then
+      if [ ! -r "$val_fileVar" ]; then
+         echo "error: file '$val_fileVar' does not exist or is not readable" >&2
+         exit 1
+      fi
+      val="$(cat "$val_fileVar")"
+   fi
+
+   export "$var"="$val"
+   unset "$fileVar"
+}
+
+file_env "MEMOS_DSN"
+
+exec "$@"

scripts/entrypoint_test.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env sh
+
+# Test script for entrypoint.sh file_env function
+# Run: ./scripts/entrypoint_test.sh
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+TEMP_DIR=$(mktemp -d)
+trap "rm -rf $TEMP_DIR" EXIT
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+pass_count=0
+fail_count=0
+
+pass() {
+    echo "${GREEN}PASS${NC}: $1"
+    pass_count=$((pass_count + 1))
+}
+
+fail() {
+    echo "${RED}FAIL${NC}: $1"
+    fail_count=$((fail_count + 1))
+}
+
+# Test 1: Direct env var works
+test_direct_env_var() {
+    unset MEMOS_DSN MEMOS_DSN_FILE
+    export MEMOS_DSN="direct_value"
+
+    result=$("$SCRIPT_DIR/entrypoint.sh" sh -c 'echo $MEMOS_DSN' 2>&1)
+    if [ "$result" = "direct_value" ]; then
+        pass "Direct env var works"
+    else
+        fail "Direct env var: expected 'direct_value', got '$result'"
+    fi
+    unset MEMOS_DSN
+}
+
+# Test 2: File env var works with readable file
+test_file_env_var_readable() {
+    unset MEMOS_DSN MEMOS_DSN_FILE
+    echo "file_value" > "$TEMP_DIR/dsn_file"
+    export MEMOS_DSN_FILE="$TEMP_DIR/dsn_file"
+
+    result=$("$SCRIPT_DIR/entrypoint.sh" sh -c 'echo $MEMOS_DSN' 2>&1)
+    if [ "$result" = "file_value" ]; then
+        pass "File env var with readable file works"
+    else
+        fail "File env var readable: expected 'file_value', got '$result'"
+    fi
+    unset MEMOS_DSN_FILE
+}
+
+# Test 3: Error when file doesn't exist
+test_file_env_var_missing() {
+    unset MEMOS_DSN MEMOS_DSN_FILE
+    export MEMOS_DSN_FILE="$TEMP_DIR/nonexistent_file"
+
+    if result=$("$SCRIPT_DIR/entrypoint.sh" sh -c 'echo $MEMOS_DSN' 2>&1); then
+        fail "Missing file should fail, but succeeded with: $result"
+    else
+        if echo "$result" | grep -q "does not exist or is not readable"; then
+            pass "Missing file returns error"
+        else
+            fail "Missing file error message unexpected: $result"
+        fi
+    fi
+    unset MEMOS_DSN_FILE
+}
+
+# Test 4: Error when file is not readable
+test_file_env_var_unreadable() {
+    unset MEMOS_DSN MEMOS_DSN_FILE
+    echo "secret" > "$TEMP_DIR/unreadable_file"
+    chmod 000 "$TEMP_DIR/unreadable_file"
+    export MEMOS_DSN_FILE="$TEMP_DIR/unreadable_file"
+
+    if result=$("$SCRIPT_DIR/entrypoint.sh" sh -c 'echo $MEMOS_DSN' 2>&1); then
+        fail "Unreadable file should fail, but succeeded with: $result"
+    else
+        if echo "$result" | grep -q "does not exist or is not readable"; then
+            pass "Unreadable file returns error"
+        else
+            fail "Unreadable file error message unexpected: $result"
+        fi
+    fi
+    chmod 644 "$TEMP_DIR/unreadable_file" 2>/dev/null || true
+    unset MEMOS_DSN_FILE
+}
+
+# Test 5: Error when both var and file are set
+test_both_set_error() {
+    unset MEMOS_DSN MEMOS_DSN_FILE
+    echo "file_value" > "$TEMP_DIR/dsn_file"
+    export MEMOS_DSN="direct_value"
+    export MEMOS_DSN_FILE="$TEMP_DIR/dsn_file"
+
+    if result=$("$SCRIPT_DIR/entrypoint.sh" sh -c 'echo $MEMOS_DSN' 2>&1); then
+        fail "Both set should fail, but succeeded with: $result"
+    else
+        if echo "$result" | grep -q "are set (but are exclusive)"; then
+            pass "Both var and file set returns error"
+        else
+            fail "Both set error message unexpected: $result"
+        fi
+    fi
+    unset MEMOS_DSN MEMOS_DSN_FILE
+}
+
+# Run all tests
+echo "Running entrypoint.sh tests..."
+echo "================================"
+
+test_direct_env_var
+test_file_env_var_readable
+test_file_env_var_missing
+test_file_env_var_unreadable
+test_both_set_error
+
+echo "================================"
+echo "Tests completed: ${GREEN}$pass_count passed${NC}, ${RED}$fail_count failed${NC}"
+
+if [ $fail_count -gt 0 ]; then
+    exit 1
+fi
+exit 0

scripts/install.sh

@@ -0,0 +1,296 @@
+#!/bin/sh
+
+set -eu
+
+REPO="${REPO:-usememos/memos}"
+BIN_NAME="memos"
+VERSION="${MEMOS_VERSION:-}"
+INSTALL_DIR="${MEMOS_INSTALL_DIR:-}"
+SKIP_CHECKSUM="${MEMOS_SKIP_CHECKSUM:-0}"
+QUIET="${MEMOS_INSTALL_QUIET:-0}"
+
+usage() {
+  cat <<'EOF'
+Install Memos from GitHub Releases.
+
+Usage:
+  install.sh [--version <version>] [--install-dir <dir>] [--repo <owner/name>] [--skip-checksum]
+
+Environment:
+  MEMOS_VERSION         Version to install. Accepts "0.28.1" or "v0.28.1". Defaults to latest release.
+  MEMOS_INSTALL_DIR     Directory to install the binary into.
+  MEMOS_SKIP_CHECKSUM   Set to 1 to skip checksum verification.
+  MEMOS_INSTALL_QUIET   Set to 1 to reduce log output.
+  REPO                  GitHub repository in owner/name form. Defaults to usememos/memos.
+
+Examples:
+  curl -fsSL https://raw.githubusercontent.com/usememos/memos/main/scripts/install.sh | sh
+  curl -fsSL https://raw.githubusercontent.com/usememos/memos/main/scripts/install.sh | sh -s -- --version 0.28.1
+EOF
+}
+
+log() {
+  if [ "$QUIET" = "1" ]; then
+    return
+  fi
+  printf '%s\n' "$*"
+}
+
+fail() {
+  printf 'Error: %s\n' "$*" >&2
+  exit 1
+}
+
+need_cmd() {
+  command -v "$1" >/dev/null 2>&1 || fail "required command not found: $1"
+}
+
+resolve_latest_version() {
+  latest_tag="$(
+    curl -fsSL \
+      -H "Accept: application/vnd.github+json" \
+      "https://api.github.com/repos/${REPO}/releases/latest" | awk -F'"' '/"tag_name":/ { print $4; exit }'
+  )"
+  [ -n "$latest_tag" ] || fail "failed to resolve latest release tag"
+  printf '%s\n' "${latest_tag#v}"
+}
+
+normalize_version() {
+  version="$1"
+  version="${version#v}"
+  [ -n "$version" ] || fail "version cannot be empty"
+  printf '%s\n' "$version"
+}
+
+detect_os() {
+  os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+  case "$os" in
+    linux)
+      printf 'linux\n'
+      ;;
+    darwin)
+      printf 'darwin\n'
+      ;;
+    *)
+      fail "unsupported operating system: $os"
+      ;;
+  esac
+}
+
+detect_arch() {
+  arch="$(uname -m)"
+  case "$arch" in
+    x86_64|amd64)
+      printf 'amd64\n'
+      ;;
+    arm64|aarch64)
+      printf 'arm64\n'
+      ;;
+    armv7l|armv7)
+      printf 'armv7\n'
+      ;;
+    *)
+      fail "unsupported architecture: $arch"
+      ;;
+  esac
+}
+
+resolve_install_dir() {
+  if [ -n "$INSTALL_DIR" ]; then
+    printf '%s\n' "$INSTALL_DIR"
+    return
+  fi
+
+  if [ -w "/usr/local/bin" ]; then
+    printf '/usr/local/bin\n'
+    return
+  fi
+
+  if command -v sudo >/dev/null 2>&1; then
+    printf '/usr/local/bin\n'
+    return
+  fi
+
+  printf '%s/.local/bin\n' "$HOME"
+}
+
+download() {
+  src="$1"
+  dest="$2"
+  if ! curl -fsSL "$src" -o "$dest"; then
+    fail "failed to download ${src}"
+  fi
+}
+
+download_optional() {
+  src="$1"
+  dest="$2"
+
+  if curl -fsSL "$src" -o "$dest" 2>/dev/null; then
+    return 0
+  fi
+
+  rm -f "$dest"
+  return 1
+}
+
+verify_checksum() {
+  archive_path="$1"
+  checksum_path="$2"
+
+  if [ "$SKIP_CHECKSUM" = "1" ]; then
+    log "Skipping checksum verification"
+    return
+  fi
+
+  if [ ! -f "$checksum_path" ]; then
+    log "Warning: checksum file not found for this release; skipping verification"
+    return
+  fi
+
+  archive_name="$(basename "$archive_path")"
+  expected_line="$(grep "  ${archive_name}\$" "$checksum_path" || true)"
+  [ -n "$expected_line" ] || fail "checksum entry not found for ${archive_name}"
+
+  if command -v sha256sum >/dev/null 2>&1; then
+    (
+      cd "$(dirname "$archive_path")"
+      printf '%s\n' "$expected_line" | sha256sum -c -
+    )
+    return
+  fi
+
+  if command -v shasum >/dev/null 2>&1; then
+    expected_sum="$(printf '%s' "$expected_line" | awk '{print $1}')"
+    actual_sum="$(shasum -a 256 "$archive_path" | awk '{print $1}')"
+    [ "$expected_sum" = "$actual_sum" ] || fail "checksum verification failed for ${archive_name}"
+    return
+  fi
+
+  log "Warning: sha256sum/shasum not found; skipping checksum verification"
+}
+
+extract_archive() {
+  archive_path="$1"
+  dest_dir="$2"
+
+  tar -xzf "$archive_path" -C "$dest_dir"
+}
+
+install_binary() {
+  src="$1"
+  dest_dir="$2"
+
+  mkdir -p "$dest_dir"
+
+  if [ -w "$dest_dir" ]; then
+    install -m 755 "$src" "${dest_dir}/${BIN_NAME}"
+    return
+  fi
+
+  if command -v sudo >/dev/null 2>&1; then
+    sudo mkdir -p "$dest_dir"
+    sudo install -m 755 "$src" "${dest_dir}/${BIN_NAME}"
+    return
+  fi
+
+  fail "install directory is not writable: $dest_dir"
+}
+
+parse_args() {
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --version)
+        [ "$#" -ge 2 ] || fail "missing value for --version"
+        VERSION="$2"
+        shift 2
+        ;;
+      --install-dir)
+        [ "$#" -ge 2 ] || fail "missing value for --install-dir"
+        INSTALL_DIR="$2"
+        shift 2
+        ;;
+      --repo)
+        [ "$#" -ge 2 ] || fail "missing value for --repo"
+        REPO="$2"
+        shift 2
+        ;;
+      --skip-checksum)
+        SKIP_CHECKSUM="1"
+        shift
+        ;;
+      --quiet)
+        QUIET="1"
+        shift
+        ;;
+      -h|--help)
+        usage
+        exit 0
+        ;;
+      *)
+        fail "unknown argument: $1"
+        ;;
+    esac
+  done
+}
+
+main() {
+  parse_args "$@"
+
+  need_cmd curl
+  need_cmd tar
+  need_cmd install
+  need_cmd uname
+  need_cmd grep
+  need_cmd awk
+  need_cmd mktemp
+
+  os="$(detect_os)"
+  arch="$(detect_arch)"
+
+  if [ -z "$VERSION" ]; then
+    VERSION="$(resolve_latest_version)"
+  fi
+  VERSION="$(normalize_version "$VERSION")"
+
+  install_dir="$(resolve_install_dir)"
+  tag="v${VERSION}"
+
+  asset_suffix="${arch}"
+  if [ "$arch" = "armv7" ]; then
+    asset_suffix="armv7"
+  fi
+
+  asset_name="${BIN_NAME}_${VERSION}_${os}_${asset_suffix}.tar.gz"
+  checksums_name="checksums.txt"
+  base_url="https://github.com/${REPO}/releases/download/${tag}"
+
+  tmpdir="$(mktemp -d)"
+  trap 'rm -rf "$tmpdir"' EXIT INT TERM
+
+  archive_path="${tmpdir}/${asset_name}"
+  checksums_path="${tmpdir}/${checksums_name}"
+  extract_dir="${tmpdir}/extract"
+
+  mkdir -p "$extract_dir"
+
+  log "Installing ${BIN_NAME} ${VERSION} for ${os}/${arch}"
+  log "Downloading ${asset_name} from ${REPO}"
+  download "${base_url}/${asset_name}" "$archive_path"
+  if ! download_optional "${base_url}/${checksums_name}" "$checksums_path"; then
+    log "Warning: ${checksums_name} is not published for ${tag}"
+  fi
+
+  verify_checksum "$archive_path" "$checksums_path"
+  extract_archive "$archive_path" "$extract_dir"
+
+  [ -f "${extract_dir}/${BIN_NAME}" ] || fail "archive did not contain ${BIN_NAME}"
+  install_binary "${extract_dir}/${BIN_NAME}" "$install_dir"
+
+  log "Installed ${BIN_NAME} to ${install_dir}/${BIN_NAME}"
+  if ! printf '%s' ":$PATH:" | grep -q ":${install_dir}:"; then
+    log "Add ${install_dir} to your PATH to run ${BIN_NAME} directly"
+  fi
+}
+
+main "$@"