We were contacted in early December by Surendra of Kreeti, who explained
that they had forked Paperclip and were maintaining it. We let the
December US holidays go by and then checked in; they're still
maintaining it.

We do not know any of the Kreeti devs and cannot vouch for them as a
team. We did not know of a way to hand over the Rubygem ownership while
expressing that people should remember to audit when upgrading.
Therefore, we felt it best that they have a full fork: new Rubygem gem,
separate repo.

Therefore it makes sense for us to link to Kreeti's fork as an option
for those who cannot move off of Paperclip.

We've linked to `http://kreeti.com` instead of `https` because, as of
this writing, they have left their site open to MITM attacks. Warn the
reader of this so they don't follow a cleartext link without necessary
preparation.

At RailsConf 2019, Colleen Schnettler gave a fantastic talk on her
real-world experience migrating from Paperclip to ActiveStorage, titled
"How to migrate to Active Storage without losing your mind".

In it she goes through the steps before and after a migration, and also
talks through the details of the migration guide, along with some
corrections.

Link to the ConfFreaks video of this talk on YouTube so more
video-minded folks can learn about the migration in a manner that is
more comfortable.

I believe this is meant to be "does not", not "does".

The official [RSpec documentation](https://relishapp.com/rspec/rspec-expectations/v/2-4/docs/custom-matchers/define-matcher#define-a-matcher-with-default-messages) outlines that the main block when defining custom matchers should be called `match`. 

The documentation currently uses `matches` when giving an example of the custom `:have_attached_file` matcher, which leads to the error 

    NoMethodError:
      undefined method `matches' for #<Class:#<RSpec::Matchers::DSL::Matcher:0x00007fc898c846d8>>

Updating to `match`

Meant to catch this in the prior commit: `key` is a SQL reserved word
and therefore must have backticks around it.

This is a combination of [a comment from @sankage] and [a gist by
@colinpetruno]. Many thanks to them for sharing their discoveries.

[a comment from @sankage]: https://github.com/thoughtbot/paperclip/pull/2568#issuecomment-381629629
[a gist by @colinpetruno]: https://gist.github.com/colinpetruno/037de4fafa4cff695b1d7905cd6fd7c2

Explain some lessons learned from successfully migrating an application
from Paperclip to ActiveStorage.

Replace links to `master` or `edgeguides.rubyonrails.org` with versions
locked to `v5.2`.

As before: use `#sql_type` instead of `#type` in the tests. The `#type` is the
category -- string, integer, datetime -- but the `#sql_type` is the storage
specifics -- `TEXT`, `VARCHAR`, `BIGINT`, `DATE. Switch to the `#sql_type` so
we can be sure it's being stored correctly.

The 4 byte limit is starting to wrap around; some complaints are being seen
online, e.g.
https://stackoverflow.com/questions/34477248/rails-paperclip-rangeerror/47999887#47999887 .

Use `#sql_type` instead of `#type` in the tests. The `#type` is the category --
string, integer, datetime -- but the `#sql_type` is the storage specifics --
`TEXT`, `VARCHAR`, `BIGINT`, `DATE. Switch to the `#sql_type` so we can be sure
it's being stored correctly.

In an effort to avoid filling $TMPDIR with stray files, let's close all
Tempfiles after we are done with them. Additionally, add an around-filter to
each test in the integration suite to catch cases where we don't do this.

This exposes issues around re-processing a subset of our attached files: it
leaves Tempfiles around. Mark that test as skipped (with a detailed
explanation) because we cannot figure out how to make it work.

Related to #1326.

As described in #2118, `OpenURI::Meta#content_type` will return
`application/octet-stream` when no `content-type` header is set. Using
the original `meta` fixes this issue.

While using the Paperclip gem, we noticed during some ad-hoc testing
that if you do not supply an extension when uploading a file, Paperclip
effectively skipped it's spoofing check, which allowed potentially
dangerous files to slip through into your application.

This addresses that by moving the checks around a little bit and only
testing against the extension when there is one.

This validation was causing issue when there is no content_type column
in the database, as the content type of the attachment would be empty.
There should be no need to check attachment's validity because this
`#reprocess!` method is running internally on the server.

Fix #2078

Encountered an issue where the URI was returning header with
content-disposition where the filename value wasn't enclosed in the
double quotes. Turns out that this is a valid grammar according to
RFC6266. Also made the logic more robust to account for spaces and
uppercase letters.

e.g., the way google stores its user profile photos (from their oauth2 API)
https://lh3.googleusercontent.com/-aRHQV4YjnBM/AAAAAAAAAAI/AAAAAAAAAAo/ngSjy9-yR5c/photo.jpg

Since the support version is Ruby 2.0 or later, magic comment is unnecessary.

> The UTF-8 default encoding, which make many magic comments omissible

https://www.ruby-lang.org/en/news/2013/02/24/ruby-2-0-0-p0-is-released/

This cause to erease previous image when the id change to above
`999_999_999`, for example:

```
2.3.6 :010 > id
 => 1000602578
2.3.6 :011 > ("%09d".freeze % id).scan(/\d{3}/).join("/".freeze)
 => "100/060/257"
```

"key" is a reserved keyword in MariaDB, so the SQL statement fails.
Surrounding the keyword in backticks fixes the error.

* Add deprecation notice to README

Addresses new projects, existing projects, issues, and PRs.