New upstream version 12.1.13

2019-10-03 12:08:05 +05:30 · 2019-10-03 12:08:05 +05:30 · 0a12a11e94
parent 916c6469bb
commit 0a12a11e94
10 changed files with 483 additions and 154 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -2,6 +2,13 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.

+## 12.1.13
+
+### Security (1 change)
+
+- Fix private feature Elasticsearch leak.
+
+
 ## 12.1.12

 ### Security (11 changes)
--- a/2
+++ b/2
@ -1 +1 @@
-12.1.12
+12.1.13
--- a/app/models/project.rb
+++ b/app/models/project.rb
@ -483,7 +483,7 @@ class Project < ApplicationRecord
  # the feature is either public, enabled, or internal with permission for the user.
  # Note: this scope doesn't enforce that the user has access to the projects, it just checks
  # that the user has access to the feature. It's important to use this scope with others
-  # that checks project authorizations first.
+  # that checks project authorizations first (e.g. `filter_by_feature_visibility`).
  #
  # This method uses an optimised version of `with_feature_access_level` for
  # logged in users to more efficiently get private projects with the given
@ -511,6 +511,11 @@ class Project < ApplicationRecord
    end
  end

+  # This scope returns projects where user has access to both the project and the feature.
+  def self.filter_by_feature_visibility(feature, user)
+    with_feature_available_for_user(feature, user).public_or_visible_to_user(user)
+  end
+
  scope :active, -> { joins(:issues, :notes, :merge_requests).order('issues.created_at, notes.created_at, merge_requests.created_at DESC') }
  scope :abandoned, -> { where('projects.last_activity_at < ?', 6.months.ago) }

--- a/app/models/project_feature.rb
+++ b/app/models/project_feature.rb
@ -62,7 +62,8 @@ class ProjectFeature < ApplicationRecord
    private

    def ensure_feature!(feature)
-      feature = feature.model_name.plural.to_sym if feature.respond_to?(:model_name)
+      feature = feature.model_name.plural if feature.respond_to?(:model_name)
+      feature = feature.to_sym
      raise ArgumentError, "invalid project feature: #{feature}" unless FEATURES.include?(feature)

      feature
--- a/spec/lib/gitlab/gpg/commit_spec.rb
+++ b/spec/lib/gitlab/gpg/commit_spec.rb
@ -202,7 +202,7 @@ describe Gitlab::Gpg::Commit do
          end

          let(:gpg_key_subkey) do
-            gpg_key.subkeys.find_by(fingerprint: '0522DD29B98F167CD8421752E38FFCAF75ABD92A')
+            gpg_key.subkeys.find_by(fingerprint: GpgHelpers::User3.subkey_fingerprints.last)
          end

          before do
--- a/spec/models/project_feature_spec.rb
+++ b/spec/models/project_feature_spec.rb
@ -178,4 +178,28 @@ describe ProjectFeature do
      it { is_expected.to eq(ProjectFeature::ENABLED) }
    end
  end
+
+  describe '.required_minimum_access_level' do
+    it 'handles reporter level' do
+      expect(described_class.required_minimum_access_level(:merge_requests)).to eq(Gitlab::Access::REPORTER)
+    end
+
+    it 'handles guest level' do
+      expect(described_class.required_minimum_access_level(:issues)).to eq(Gitlab::Access::GUEST)
+    end
+
+    it 'accepts ActiveModel' do
+      expect(described_class.required_minimum_access_level(MergeRequest)).to eq(Gitlab::Access::REPORTER)
+    end
+
+    it 'accepts string' do
+      expect(described_class.required_minimum_access_level('merge_requests')).to eq(Gitlab::Access::REPORTER)
+    end
+
+    it 'raises error if feature is invalid' do
+      expect do
+        described_class.required_minimum_access_level(:foos)
+      end.to raise_error
+    end
+  end
 end
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@ -3308,6 +3308,36 @@ describe Project do
    end
  end

+  describe '.filter_by_feature_visibility' do
+    include_context 'ProjectPolicyTable context'
+    include ProjectHelpers
+    using RSpec::Parameterized::TableSyntax
+
+    set(:group) { create(:group) }
+    let!(:project) { create(:project, project_level, namespace: group ) }
+    let(:user) { create_user_from_membership(project, membership) }
+
+    context 'reporter level access' do
+      let(:feature) { MergeRequest }
+
+      where(:project_level, :feature_access_level, :membership, :expected_count) do
+        permission_table_for_reporter_feature_access
+      end
+
+      with_them do
+        it "respects visibility" do
+          update_feature_access_level(project, feature_access_level)
+
+          expected_objects = expected_count == 1 ? [project] : []
+
+          expect(
+            described_class.filter_by_feature_visibility(feature, user)
+          ).to eq(expected_objects)
+        end
+      end
+    end
+  end
+
  describe '#pages_available?' do
    let(:project) { create(:project, group: group) }

--- a/spec/support/helpers/gpg_helpers.rb
+++ b/spec/support/helpers/gpg_helpers.rb
@ -254,24 +254,29 @@ module GpgHelpers
      <<~SIGNATURE
        -----BEGIN PGP SIGNATURE-----

-        iQEzBAABCAAdFiEEBSLdKbmPFnzYQhdS44/8r3Wr2SoFAlnNlT8ACgkQ44/8r3Wr
-        2SqP1wf9FC4J2S8LIHs/fpxgkYzsyCp5lCbS7JuoD4pqmI2KWyBx+vi9/3mZPCsm
-        Fj9f0vFEtNOb39GNGZbaA8DdGw30/WAS6kI6yco0WSK53KHrLw9Kqd+3e/NAVSsl
-        991Gq4n8X1U5izSH+gZOMtEEUBGqIlZKgRrEh7lhNcz0G7JTF2VCE4NNtZdq7GDA
-        N6jOQxDGUwi9wQBYORQzIBc3NihfhGloII1hXf0XzrgUY3zNYHTT7QipCxKAmH54
-        skwW+wi8RpBedar4saf7fs5xZbP/0yyVz98MJMdHBL68++Xt1AIHoqrb7eWszqnd
-        PCo/fnz1iHKCig602KLj0/zhADcNkg==
-        =LsTi
+        iQIzBAABCAAdFiEEOtBpdPeN0WA9XkYX0JVdIvLDJOIFAl2QZqAACgkQ0JVdIvLD
+        JOKeGw//b1hJ/ZVNc/iBoDd5rOgjTm50tU+7n+y1wbodVQoDWxeObZpS6Rfo2b63
+        U8WrGrePdP9QLTqMKRpJlZ0SnVFRTUC2eTO1zL527fDOXnyaUxPiBlBDGi3EaSGL
+        qzsDB5oH8gJY9TyZ3uczYMyAKzMGuRCkLkEgKV6JCTK8MWpKWOIJ6Y9Za9xkn83g
+        w+/3aQDBk2kVL3LAD8XxGNkji8agvoIv0l8gefXAT1tyhu0PIHbWu2FUX0+gQnVY
+        6TlwiA+xpOY+nwg/yPL/CKFkHg84lTuZ3jrvndCjAv5erHrW/3H6b15e63Iu/vyn
+        1NZpZoY+/DjIKtxyB7JepC+VTzRui2NtYm6d1YWqrHo+kDxh6q1FDXuAxm/SxZh3
+        N8ybHvjq0S1pv6y21VCMV0aBAsgk9OhspO2n3VdcX2eUOvwNaZCVn6jOVcriwrF7
+        SjDeXenF9sDclRx3OHx9qs3H9/ayRBROWjnJHeqsiJeJi7NlgndFmzXcqJMURGxM
+        6Tgrd1KczRKOvS3rkl//3EP7HCsrg/0VNiSdeRjEvkqjyb7HNhOFAz41hPsad4Gj
+        SXC9/HWFQjGxzwk2GSoYh5np+rDLgTfhISrXeQD4c8pb7NqoB7mlnwp7xza+cwGd
+        Ggo/XNakLZJDpRSABKqCJ5QUzc8Q5IhRQFOKeV2w/LISGTIJvYk=
+        =GGuq
        -----END PGP SIGNATURE-----
      SIGNATURE
    end

    def signed_commit_base_data
      <<~SIGNEDDATA
-        tree 86ec18bfe87ad42a782fdabd8310f9b7ac750f51
-        parent 2d1096e3a0ecf1d2baf6dee036cc80775d4940ba
-        author John Doe <john.doe@example.com> 1506645311 -0500
-        committer John Doe <john.doe@example.com> 1506645311 -0500
+        tree 2bdf04adb23d2b40b6085efb230856e5e2a775b7
+        parent 3e08e7c44e3005032d3de125697883797f9bd035
+        author John Doe <john.doe@example.com> 1569744544 +1300
+        committer John Doe <john.doe@example.com> 1569744544 +1300

        Commit signed with subkey by John Doe
      SIGNEDDATA
@ -281,52 +286,89 @@ module GpgHelpers
      <<~KEY.strip
        -----BEGIN PGP PUBLIC KEY BLOCK-----

-        mQENBFnNgbIBCAC9/WblcR4s/pFTwh9cm2iS59YRhtGfbrnfNE6QMIFIRFaK0u6J
-        LDy+scipXLoGg7X0XNFLW6Y457UUpkaPDVLPuVMONhMXdVqndGVvk9jq3D4oDtRa
-        ukucuXr9F84lHnjL3EosmAUiK3xBmHOGHm8+bvKbgPOdvre48YxoJ1POTen+chfo
-        YtLUfnC9EEGY/bn00aaXm3NV+zZK2zio5bFX9YLWSNh/JaXxuJsLoHR/lVrU7CLt
-        FCaGcPQ9SU46LHPshEYWO7ZsjEYJsYYOIOEzfcfR47T2EDTa6mVc++gC5TCoY3Ql
-        jccgm+EM0LvyEHwupEpxzCg2VsT0yoedhUhtABEBAAG0H0pvaG4gRG9lIDxqb2hu
-        LmRvZUBleGFtcGxlLmNvbT6JAVQEEwEIAD4WIQTqP4uIlyqP1HSHLy8RWzrxqtPt
-        ugUCWc2BsgIbAwUJA8JnAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRARWzrx
-        qtPturMDCACc1Pi1sLJFcCnJEc9sCInCO4LH8fntNjRLN3MTPU5YCYmFM3fAl5ly
-        vXPZ4jNWZxKbQVeFnkDOg5Ti8bzmFEMc8KbZuguktVFizxnLdFCTTRO89i3HDVSN
-        bIosrs5HJwRKOzul6i2whn3dsr8/P8WJczYjZGiw29hGwH3md4Thn/aAGbzjoCEF
-        IfIb1kccyHMJkaj79S8B2agsbEJLuTSfsXC3kGZIJyKG1DNmDUHW/ZE6ro/Kkhik
-        3w6Jw14cMsKUIOBkOgsD/gXgX9xxWjYHmKrbCXucTKUevNlaCy5tzwrC0Am3prl9
-        OJj3macOA8hNaTVDflEHNCwHOwqnVQYyuQENBFnNgbIBCAC59MmKc0cqPRPTpCZ5
-        arKRoj23SNKWMDWaxSELdU91Wd/NJk4wF25urk9BtBuwjzaBMqb/xPD88yJC3ucs
-        2LwCyAb5C/dHcPOpys8Pd+KrdHDR3zAMjcASsizlW/qFI9MtjhcU9Yd6iTUejAZG
-        NEC76WALJ3SLYzCaDkHFjWpH3Xq6ck3/9jpL3csn/5GLCsZQUDYGrZSXvHAIigwW
-        Xo6tMs5LCCO9CZg2qGDpvqlzcmy6CRkf0h/UFYJzGqfbJtxeCIxa93WIPE8eGwao
-        aneDlNtIoYiP6krC3OLsaPWT58QltNKaQuZSpjwtQBHa4JIt55vx+FcvRb7Kflgf
-        fT8bABEBAAGJATwEGAEIACYWIQTqP4uIlyqP1HSHLy8RWzrxqtPtugUCWc2BsgIb
-        DAUJA8JnAAAKCRARWzrxqtPtuqJjCACj+Z4qtgMpJXx3u58wCzkVLl5IylD/tEPA
-        cNIrj8QS8ec+woTJaMGVCh96VC2FPl8KR4Hjhy0yaupyPbTI6VWib63S/NcDfG7r
-        tviRFG2Gf8yduERebyC0cpgnmjVgFfJs7N3K3ncz6myOr9idNI05OC9poL73sDUv
-        jRXhm7uy938bT/R4MQdpYuxucgU3MiwvfG5ht+oJ4Yp+/IrR2PTqRGqMCsodnroa
-        TBKq2kW565TtCvrFkNub/ytorDbIVN9VrIMcuTiOv8sLoQRDJO9HvWUhYAqMY6Uh
-        dy12jR9FrquZnGsDKKs9V0Y6J4Wi8vnmdgWVZUc40pfXq3APAB6suQENBFnNgeAB
-        CADFqQRxLHxLIQ7B72diTMI2tPk9d5c67k+Gzkrg1QYoxBLdRCmhM4ydYqZzvIz4
-        1npkK20w4somOCwvyAOjO46IGb3f/Wk8mY8o5HMpI1miAfze0YTZKzRo2DmrvwbV
-        /h8jvZNCISwtrOgaaszWSVSuEQQCA1jf4qixfCb3ReETvZc3MTZXhw8IUbszXh5d
-        a6CYqq/fr5Zw4Dc19ZSoHSTh0Wn03mEm/kaYtia/wt1I+xVvTSaC2Pf/kUtr7UEf
-        3NMc0YF0s4KgeW8KwjHa7Sz9wzydLPRH5kJ26SDUGUhrFf1jNLIegtDsoISV/86G
-        ztXcVq5GY6lXMwmsggRe++7xABEBAAGJAmwEGAEIACAWIQTqP4uIlyqP1HSHLy8R
-        WzrxqtPtugUCWc2B4AIbAgFACRARWzrxqtPtusB0IAQZAQgAHRYhBAUi3Sm5jxZ8
-        2EIXUuOP/K91q9kqBQJZzYHgAAoJEOOP/K91q9kqlHcH+wbvD14ITYDMfgIfy67O
-        4Qcmgf1qzGXhpsABz/i/EPgRD990eNBI0YGuvoKRJfetEGn7LerrrCB8Z+ICFPHF
-        rzXoe10zm+QTREck0OB8nPFRycJ+Fbl6JX+cnkEx27Mmg1aVb7+H5LMDaWO1KjLs
-        g2wIDo/jrDfW7NoZzy4XTd7jFCOt4fftL/dhiujQmhLzugZXCxRISOVdmgilDJQo
-        Tz1sEm34ida98JFjdzSgkUvJ/pFTZ21ThCNxlUf01Hr2Pdcg1e2/97sZocMFTY2J
-        KwmiW2LG3B05/VrRtdvsCVj8G49coxgPPKty+m71ovAXdS/CvVqE7TefCplsYJ1d
-        V3abwwf/Xl2SxzbAKbrYMgZfdGzpPg2u6982WvfGIVfjFJh9veHZAbfkPcjdAD2X
-        e67Y4BeKG2OQQqeOY2y+81A7PaehgHzbFHJG/4RjqB66efrZAg4DgIdbr4oyMoUJ
-        VVsl0wfYSIvnd4kvWXYICVwk53HLA3wIowZAsJ1LT2byAKbUzayLzTekrTzGcwQk
-        g2XT798ev2QuR5Ki5x8MULBFX4Lhd03+uGOxjhNPQD6DAAHCQLaXQhaGuyMgt5hD
-        t0nF3yuw3Eg4Ygcbtm24rZXOHJc9bDKeRiWZz1dIyYYVJmHSQwOVXkAwJlF1sIgy
-        /jQYeOgFDKq20x86WulkvsUtBoaZJg==
-        =Q5Z7
+        mQINBF2QYYMBEACrIy5plkXAGvh95RWhPhN2JVnBkcIuflojdsdOzqbrm4nMmkqc
+        qU8XHcz6+MhqBH370XIW3QxJ2RXQEz6ycHGNkM8PFPP8uFPE8O1zEUdIT5+j000V
+        MoNdKBhxwvloMCjaMrYBBCcpd5eJclSsg8d9TOxYDnjlVWzOQuFhQ7bFmTGKaD5X
+        RPG/73VN6HqfqtnIgzVTcOLYZc2pFAfxLpVMAg/igXdxgpp8ooovKzrHC4a6WkvJ
+        CsYUksu2P2CbRZcahvJnbf5x7dXdfzPrzu4ZidnLtIq694+bDuJ2nhxL/9775utW
+        4i1ExziEq8xdndz/EKlY1fowLEPA2wuB5VqtR2choY1FjwSMQiPL/dJEFIBwOJeN
+        morQNhsPRzdM7LUXmU7SblYQYJTuBnZbFUHCBRA2rAGFwWAJe9f8wDqDH2Y3oHpk
+        bPE1LAzIW2BF56otWfYYyL3IxxjyDJsEPbN9JPJ9LpGdco/UqLe6sZFaDGhRnOpq
+        v7tyMVKkX42sGHRp6CB+2g3SjQWGbx3ebNN8pFoIHsHYJXIu3FhygbAZi67jLUA7
+        O/uyLpy9jNaGwQTHJEcv/FwBA8pcKVwGniahgsDCfLNiQDQxagXEwILEie0pLROE
+        UtaXwe0Fv8KbbEFRY4NKuIKYzc2R5YknRsfoiG82ikPZA2P4wj/Gu+H7GQARAQAB
+        tB9Kb2huIERvZSA8am9obi5kb2VAZXhhbXBsZS5jb20+iQJOBBMBCAA4FiEEwpdE
+        OMao+swzcSkdKFlQIWM8hCEFAl2QYYMCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgEC
+        F4AACgkQKFlQIWM8hCFPuA//YgLYIVZVEt/O0QpXpugQwyEwake8ogVJmDQevcU5
+        4n/e0NrcML7wvVj32Xw+N2c2aKsbPM7SFqZRCErTtCLLaUFATsUffceuy46CJwW3
+        PciPTCCawldYC8HWHLTFNefrib8hY5zfScoQoOGTnURDWh7WlnaTz+2dU/aXKptV
+        h4W6HW6YJjYt6Nrrj7kUwl4BNjzyJy0uM7IWFyweFfe7KDuFf0N3aCl1ye2jz+VI
+        dwiqUaG8sq7VoWHcxjpeXGu64JJLai01tOVuzqQN+YxEGuwIIxKzWTKCVIu8yBUb
+        0m596XK/8a2sObK2kE6sh01NiGL0gN9xrax7HtnJTflgyoR1yQvFB4qv7Mx4++wE
+        8JOVEN1qVsR+ipOhAonWM+3uFXsUhZixs7bTOgV5wJOLe2JDCFNdeYIWBUe9FMr+
+        wF1i+YRYyAnMPUvb2oTg4t2nRv+UF9tMBPsDi+ZLRqnFsUPaeu2r0WPLIImLW6oW
+        gaD82gpuBc5OCNVS8G+F56CLk89g5doC0/wOf63SKkIrm+/jxuGknh/9kHvb2bbq
+        /Ag0jZ3RRLUi7M48zyspT98ad+2PkoAdEAE2d1sOzlGCxHn12yPL9hgxMnP1UWMx
+        7k2LdmkOd+72/cMiYR0MvaECAX2Gj8LDJQo8p2S+35eSd6UqM2/zZZT+YewP4x5l
+        GUq5Ag0EXZBhgwEQAM47B6UhLCWGZ/D8ntWteYCszNpFfgXyvnSXURb4kS33l+nu
+        eHllZ6we+blrUCH12sMyGnjY02kYFDluia3RLA6BJk5z9m6oKAx2T36HJu1aEB0z
+        g7KUCVtvCztE3jRxBV0G9kk38zgHtwjqiWm+l4UO/f6utJjWYmTUHMIfTLwpnA8z
+        UKhO1dlf8zNlTrvQxe9GGhoRPpmshsa087LLMf0naNmI2hNxblW+vP/lpPBxKAbq
+        UJiWDC7BX3HFg3NfR9lsgWaeYk7TdtVKxH2nHzlhsQZqXD5hz+Q9DW/7b1pk1W5L
+        aFv9DEQh/lQGp5ubsiy9UHrhLsTXCKk57HIOyiKFy2mTG3gD2P/g4ya43CKI7K4q
+        KQv3+1DAzzSLq28xM7Tv0b0Mygq9wLK90SVukJeS9c2ltKPiQs+4dOvr2Ep+rHKS
+        huecqwOWr0aikD/u4vAMQg1jkSDWdmfHJKb4dB7DpSF08C1CsLr476Ebpd0R/86q
+        SznP7fIYpcKR++WYO90vbSBhn0MFt5M5Qke4jVJaAfUHwzdU9WkP5LjnhY5pBvH4
+        4flFZMMc4XB2cIOaU+5EtYO4sE5BePhAT3SBBqQeRLL7qSW52ZDzlEvHk1PIVUgi
+        xZOMdb+lvaVhR8gTHLKVNCFPXqtJi7XuCyn2RyuHAhrjIt78jEoYOKgzlcntABEB
+        AAGJAjYEGAEIACAWIQTCl0Q4xqj6zDNxKR0oWVAhYzyEIQUCXZBhgwIbDAAKCRAo
+        WVAhYzyEIVKhD/sFjOKlW7xnitJzGUOcmjWIUdyQdbuuYyeATueitCKrcerNuzfq
+        Zo4vjz+w591IF/BQNP9GxS5bofyw5dX1y4VkrBFaWBwWq3uDUFQKlz4PZEIoxBoS
+        FQaa2ZlAVTzTuwJgaouPoQdakwmgWCSa1tpzX1mofQ6+2oaWdFec2ARMJVzyII+J
+        ARh+6XY+k232Z0cOvosSMvsNCh6l2AoxALqvVB414fC4sR00AipPM+p0z5SUbFO0
+        hsNKIFFrxYPU8g/AQOp4cUVxHcsrnJj1YvNs7KjpwDBr908dgvcemLOCZj4yvGKi
+        kfM3FwUioX1tTaPROJruH83nyx0aSveaXrs0M6X2mOAQ8SPasQZUCnI4jjqX0x/2
+        /9Os7UqD038U0pTMCuv4VYrUvkkrRaRx66myJgGb2luBZS73uyD63skE9cfsafmA
+        02plEOJqbRhSblYA6kU42fgWtXDNly/pGzb2qJp28K5L2w91oMmBqSWJBsYvp/m+
+        8RpFD8XtWZz3VqoVQPFNfN9G6MgEos4qgE3XGCHgSUZMuBFT4T1O5AL5aTqb52y4
+        b0S0WyMyBR8GuImPDr0f/me/nIWIi5BJVf1+8KXdA7V+Je8zJj0Vd9HL6dGLp+4B
+        i6qYpw2JEtecJjBYkOn9SBecOqBJJcB7d/jnnYo9vFW1EYsJ2TV3O2PFsLkCDQRd
+        kGQNARAAs5WJlq8AkUanARvx03zkrWDzMe4diH2RuiTSI/mr0qUx/82W1t6O5Hv5
+        PkssgGTh1mwfN4VMgF+tdiluZXxCZLvpQt0TIaxThKyysPMeAtGawtUDvGmhYqia
+        jiKaxKhL+AGVDJrXIa6AMIJTiHKTvNjjFtA6S5M9YJ5VB2HJdwh7pAAYaPXlamWD
+        zWt/JmArs251/4W6dG6WK+oSlZeZ2hqa92VrHRj/hrjG9p21xVHEw8fduTgXNiNc
+        qF5BzNO/TY/Iq/+I63SoNsRNt9R/84R8ST/gw0T766QvGE0XzQdoeD9Z/Q1bkwKt
+        PXnT908ZMcK+kiv0wkc+yyBpIiv0rwrS9MmgNWwpO/490UnkQsF0OqVSyT8AdqMa
+        nVyddlWVbIZJpR2TPX3zHFKbULlqAZEaA75MC8gtFYcRinGhPbqVvWMnubuoS5Tz
+        5vWTwGOHjy0zApA2TDF/eP5NBbdv2Uaj+KRX8To22RWkEESa5f0uQ03M4St98Usb
+        9szsKx0GFNltBpmq55EjpEbdDNPiOoZ+Y3ZIKcc6XPhNE9O86jtxqx3KNTgWupme
+        LyTohA1VzCGXjyYNSG0GuDSwmU2ET9JcUfPpPMMejeHDiJON+lo0ObeJxz8L9dgh
+        xyay9rOzQ44/4+1fH30+H0H6zKaWfG4MbHvIzx7AXe3Tlh7aQCcAEQEAAYkEbAQY
+        AQgAIBYhBMKXRDjGqPrMM3EpHShZUCFjPIQhBQJdkGQNAhsCAkAJEChZUCFjPIQh
+        wXQgBBkBCAAdFiEEOtBpdPeN0WA9XkYX0JVdIvLDJOIFAl2QZA0ACgkQ0JVdIvLD
+        JOJHCQ//dYB0OuwIgtSLLMuBnxjBuwEA27Fj5iL+gBr22vpbYtWgUvfkAa9s/qm/
+        Z2tL2xJE/HN+eRO9AXBu3dWQeMPEWamd00eQktTFFpjqAOeeOCFRbCbRlWreAy4E
+        S480IakHeOk9fNEnOCPqgtC/UdWIG+HqhDCPOVaaa3zyqrGLx/+6ihdL9ztIuNoY
+        W1l1pXfNSPJxp9HGiQvGhuL/+34DQ7Hv5W0SYKS6jTqreFAOkQdsfNenzQk6YFm7
+        TbhycAVH7IkjsX0s5EqLZpCZssHh5hmm14GLkbGUy3fGFLTSg5uI92ZDdjJQYpUi
+        xIis/mPbDbQ7p3rOQayxVdDpzyCfPNks5kAfHFj0lGOxOb3eEZUXxKcbP5QgqjTO
+        WmNaQRnLN0ZUfZICt4m/t3VvuGmoO66IH7b2F6iMpzO+BH9RqDGKkBkfgdeqkVSr
+        IXW/og3dsccfAewcCjij3hRyMnr4wwEBL4CJAFYoagtPdEOp9IAVZaAXh98nQL2X
+        1y1/MSbzZT9hH7vDjYh8wpAYxbR5nxZWILDI9ZP2JE2C9PWpDzupwYLgkJ/L0d/k
+        pW93c5raSXInOB4hVUGUaGtqpJB1aeuzTrs6Rb+2Py8ECbFn4SH7c0OJrlPoRhWT
+        vu/g7z4Lhe+mNHoNSfJc3hkzmTRrspknQfIRKmvOqc5BMGQAg8g1Wg//YVPK997C
+        73rPEL2/syAQtn3oINtHLLsgx0fn+pGV+BDl1aEdaTlF5kBprYAOC6oZQxnEbH+F
+        lZ7ad6GanvRwY0/HiAo5WmIH0u5NAcezTnppwX150Zs5rRBH0fbT/+I6CNYoEyGf
+        X5yBmMhfc1gbS+il+Z68yiXoJ6Tkht/8PqHePj5u7ySJiiG1fEn7X8f1WjmHKuyU
+        qauX6jOUGsIaO3q5NshUiIhhydbuzgrnAS0JXdjc4rrGUxscI5QU0Hqj3hkvczeD
+        eMrNEwBTbDaB9aNvHbYP+L3y7BUopgLJkP7ObZzcS0uFcv+STDKKAgKFoqoStZN3
+        5/3jXuar+d68aVObKDr5tbKGT6w7EeUPkqqLolKxUyDDHO5YXchMJw8SpVc+GenC
+        4kx1JPqnPbJSsvRgZPP6t3AJFh4GcTCV9wIPO/YIBrFZHGgKB58u9XWjIJ0tdOvv
+        dGrrugazh2Zn8ymOL80ENTSe75DsIJlZSj4AAI/vDB16voU9nQi/XoOvfizw6tm1
+        frkReFyr9/gC3qqnc52u6I6VMsGkhSkRYIoLAwpF+XysGp8ho707Gf38RnHOxemS
+        jelz6JZDx65wI+B1KJDNCFHxQ3ky3sah9AQbzUVN3Mi1kKkB7jXOqMMlZs0hf22Y
+        embi+Bu7rmDr/adQN4wqXHHNIYEd2/h4D2Y=
+        =jT2d
        -----END PGP PUBLIC KEY BLOCK-----
      KEY
    end
@ -335,106 +377,183 @@ module GpgHelpers
      <<~SECRET
        -----BEGIN PGP PRIVATE KEY BLOCK-----

-        lQPGBFnNgbIBCAC9/WblcR4s/pFTwh9cm2iS59YRhtGfbrnfNE6QMIFIRFaK0u6J
-        LDy+scipXLoGg7X0XNFLW6Y457UUpkaPDVLPuVMONhMXdVqndGVvk9jq3D4oDtRa
-        ukucuXr9F84lHnjL3EosmAUiK3xBmHOGHm8+bvKbgPOdvre48YxoJ1POTen+chfo
-        YtLUfnC9EEGY/bn00aaXm3NV+zZK2zio5bFX9YLWSNh/JaXxuJsLoHR/lVrU7CLt
-        FCaGcPQ9SU46LHPshEYWO7ZsjEYJsYYOIOEzfcfR47T2EDTa6mVc++gC5TCoY3Ql
-        jccgm+EM0LvyEHwupEpxzCg2VsT0yoedhUhtABEBAAH+BwMCOqjIWtWBMo3mjIP1
-        OnIbZ+YJxSUZ/B8wU2loMv4XiKmeXLbjD6h3jojxYlnreSHA9QvoY8uNaWElL/n2
-        jv6bxluivk8tA9FWJVv4HaSlMDd2J2YmUW17r8z9Kvm7b7pFVSrEoYV93Wdj5FJ7
-        ciKrFhYNSD7tH1sHwkrFAbiv6aHyk9h48YmR3kx2wBvz+pWk7M2srCJx2b6DXkj/
-        fsj1c/vnzUUGooOJgOvYAWrpg/rJUNxSsFypAHf8Xtk+xt8S1aZ9jaCmYk6I1B2L
-        m00HP43cXUpKcmETW1zXvfMLKjjoUEAJhSJhbCwiEzGL4ojQTarl8qbb+MisakEJ
-        DkPYtrhiiuVzUIFfqE86yO0UKidtzBmJAW3c6zeiUATvACzU09aGyUY1cJi93oXD
-        w4PCyVZ+nMvGD1wx+gyYdDINwpX4y6od9RDr06DGCzwu+S2vxsu1T8LdSv52fhBr
-        U0FY3Z3VN1ytay4SHi/8Y9VBYQFBh7R7Ch0gEMxLVKXVNqOXHUdGrKWV/WmyLKuZ
-        W9DEnWU4Mpz/di5jU8EDW7EB9DZZhVk3mQw3nuAZrBGD4azmmD5mgSgLeBGmKZ1e
-        q/9IWO44mRBBUtNv+rAkmmYF3MCNHuc7EMj+c/IgBUC7d5qBzGWA3UJ0vKX4xcIQ
-        X/PnU+nGxNvBrdqQaMLczeg28SerojxuX79prOsoySctLAbajd9HshW5SfOZ0rvb
-        BNHPqolQDijYEHGxANh4BbamRMGi60Rop7vJsZOLAemz17x/mvCtAHISOJT77/IM
-        oWC+IksJ5XsA/klJGe/tkx11aRQDDmKvIJXmMuRdvnIR23UBbzRQlWWq0l6CdoF6
-        6SQ9BJBFq0WY32No9WZAPnDO3buUzWc1Y3uwn/+h7TVYVyTlEqzpYJ9FoJwBHbor
-        0663eoyz6+AUtB9Kb2huIERvZSA8am9obi5kb2VAZXhhbXBsZS5jb20+iQFUBBMB
-        CAA+FiEE6j+LiJcqj9R0hy8vEVs68arT7boFAlnNgbICGwMFCQPCZwAFCwkIBwIG
-        FQgJCgsCBBYCAwECHgECF4AACgkQEVs68arT7bqzAwgAnNT4tbCyRXApyRHPbAiJ
-        wjuCx/H57TY0SzdzEz1OWAmJhTN3wJeZcr1z2eIzVmcSm0FXhZ5AzoOU4vG85hRD
-        HPCm2boLpLVRYs8Zy3RQk00TvPYtxw1UjWyKLK7ORycESjs7peotsIZ93bK/Pz/F
-        iXM2I2RosNvYRsB95neE4Z/2gBm846AhBSHyG9ZHHMhzCZGo+/UvAdmoLGxCS7k0
-        n7Fwt5BmSCcihtQzZg1B1v2ROq6PypIYpN8OicNeHDLClCDgZDoLA/4F4F/ccVo2
-        B5iq2wl7nEylHrzZWgsubc8KwtAJt6a5fTiY95mnDgPITWk1Q35RBzQsBzsKp1UG
-        Mp0DxgRZzYGyAQgAufTJinNHKj0T06QmeWqykaI9t0jSljA1msUhC3VPdVnfzSZO
-        MBdubq5PQbQbsI82gTKm/8Tw/PMiQt7nLNi8AsgG+Qv3R3DzqcrPD3fiq3Rw0d8w
-        DI3AErIs5Vv6hSPTLY4XFPWHeok1HowGRjRAu+lgCyd0i2Mwmg5BxY1qR916unJN
-        //Y6S93LJ/+RiwrGUFA2Bq2Ul7xwCIoMFl6OrTLOSwgjvQmYNqhg6b6pc3JsugkZ
-        H9If1BWCcxqn2ybcXgiMWvd1iDxPHhsGqGp3g5TbSKGIj+pKwtzi7Gj1k+fEJbTS
-        mkLmUqY8LUAR2uCSLeeb8fhXL0W+yn5YH30/GwARAQAB/gcDAuYn/gmAA3OC5p5Q
-        Pat5kE7MtmSvSPmdjVA2o+6RtqZf81JqtAgtDVDwj7SPFsH6ue5P+iAn9938YYek
-        WQU2+0GXeUbSJt+u4VAchgwA5mYsEnEr1/E5KEfWPWO3jJol1rJG99adrjkMxvug
-        QJmwieqhu0368w1FU0tKstxYbr3Tz3nPCPDJoigMEUkXiFklDCUgeNk0g+zd5ytE
-        lXuuLYcGZX7njxL5jD+cMIKqua5zv8WbvNf/BhM1nCarxp4qzKWim8J8jY+iR+/E
-        qOar4aliGRez0j+qh/r8ywgPwfOO89zrKrMfaclL7dN9yuecmBHKWZvfrP5JKMHj
-        yTU3nRMhUGbfVUaaZI2Ccz2rNOU4oF9wuzpzQi8qOysZixRmH61Nw3ULIKoQgiWp
-        0p5A3L94OaEfZEq3plVaIXI2YWYFSEAlIAc2dq4GxynousLdhNACi9bHhXrfFUhK
-        ckw1QlbhguO/j63/x8ygsmLZVwHG0fJZtMhT3+EGam9cuMBibIYyu3ufJRy7kMKt
-        kmyuk02X+hYJ7w8Pu6b8zYHBXbsEKamipMgd4oKtc8WnXILZo4lwDSArgs7ZVCBa
-        vGBbpTOsr54WjsyuCdX/wv0F2l31J87UxVtTKXx/+nfMfCE02zd+NsTgqvgqmkaA
-        Sy3qvv326kJNx7p+5hRwDzlAZ7vGJjj5TwCbGYDvctIf6MFrGDRNYwrGwNkPc3TG
-        rturfeL/ioua0Smj8LIbOv9Ir93gUIseNpxv8tXV/lffdIplcw802b3aXIKyv4fq
-        b9y3Oq/pDHFukKuBe9WTXJvjT0+ME+a0C8KIb/sts95pmjZsgN1kPmvuT0ReQwUR
-        eGrqz387bnVUzo4RgM3IERs/0EYzPzE8A2vc1e4/87b5J+1Xnov8Phd29vW8Td5l
-        ApiFrFO2r+/Np4kBPAQYAQgAJhYhBOo/i4iXKo/UdIcvLxFbOvGq0+26BQJZzYGy
-        AhsMBQkDwmcAAAoJEBFbOvGq0+26omMIAKP5niq2AyklfHe7nzALORUuXkjKUP+0
-        Q8Bw0iuPxBLx5z7ChMlowZUKH3pULYU+XwpHgeOHLTJq6nI9tMjpVaJvrdL81wN8
-        buu2+JEUbYZ/zJ24RF5vILRymCeaNWAV8mzs3credzPqbI6v2J00jTk4L2mgvvew
-        NS+NFeGbu7L3fxtP9HgxB2li7G5yBTcyLC98bmG36gnhin78itHY9OpEaowKyh2e
-        uhpMEqraRbnrlO0K+sWQ25v/K2isNshU31Wsgxy5OI6/ywuhBEMk70e9ZSFgCoxj
-        pSF3LXaNH0Wuq5mcawMoqz1XRjonhaLy+eZ2BZVlRzjSl9ercA8AHqydA8YEWc2B
-        4AEIAMWpBHEsfEshDsHvZ2JMwja0+T13lzruT4bOSuDVBijEEt1EKaEzjJ1ipnO8
-        jPjWemQrbTDiyiY4LC/IA6M7jogZvd/9aTyZjyjkcykjWaIB/N7RhNkrNGjYOau/
-        BtX+HyO9k0IhLC2s6BpqzNZJVK4RBAIDWN/iqLF8JvdF4RO9lzcxNleHDwhRuzNe
-        Hl1roJiqr9+vlnDgNzX1lKgdJOHRafTeYSb+Rpi2Jr/C3Uj7FW9NJoLY9/+RS2vt
-        QR/c0xzRgXSzgqB5bwrCMdrtLP3DPJ0s9EfmQnbpINQZSGsV/WM0sh6C0OyghJX/
-        zobO1dxWrkZjqVczCayCBF777vEAEQEAAf4HAwKESvCIDq5QNeadnSvpkZemItPO
-        lDf+7Wiue2gt776D5xkVyT7WkgTQv+IGWGtqz7pCCO2rMp/F9u1BghdjY46jtrK6
-        MMFKta4YENUhRliH6M2YmRjq5p7xZgH6UOnDlqsafbfyUx30t59tbQj+07aMnH5J
-        LMm37nVkDvo3wpPQPuo7L6qizYsrHrQKeJZ8636u41UjC99lVH7vXzqXw68FJImi
-        XdMZbEVBIprYfCDem+fD6gJBA4JBqWJMxuFMfhWp+1WtYoeNojDm4KxBzc2fvYV/
-        HOIUfLFBvACD/UwU5ovllHN39/O8SMgyLm9ymx2/qXcdIkUz4l7fhOCY1OW12DMu
-        5OFrrTteGK/Sj4Z8pYRdMdaKyjIlxuVzEQGWsU5+J2ALao5atEHguqwlD3cKh3G8
-        1sA/l5eTFDt84erYv1MVStV0BhZaCE4mNL4WpnQGDdW05yoGq9jIyLcurb/k/atU
-        TUkAF1csgNlJlR3IP+7U9xfHkjMO5+SV82xoNf9nBjz06TRdnvOSKsMNKp0RxC/L
-        Hbiee9o7Rxqdiyv0ly6bCCymwfvlsEIqo3YKssBfe3XI5yQI2hF9QZaH1ywzmgaH
-        o+rbME/XxddRJueS79eipT7K05Z3ulSHTXzpDw+jZcdUV0Ac72Q9FTDPMl3xc6NW
-        DrYwWw/3+kyZ4SkP56l7KlGczTyNPvU9iou4Cj/cAZk/pHx68Chq8ZZNznFm/bIF
-        gWt3fqE/n+y78B6MI8qTjGJOR0jycxrLH82Z2F+FpMShI2C5NnOa/Ilkv3e2Q5U6
-        MOAwaCIz6RHhcI99O/yta2vLelWZqn2g86rLzTG0HlIABTCPYotwetHh0hsrkSv9
-        Kh6rOzGB4i8lRqcBVY+alMSiRBlzkwpL4YUcO6f3vEDncQ9evE1AQCpD4jUJjB1H
-        JSSJAmwEGAEIACAWIQTqP4uIlyqP1HSHLy8RWzrxqtPtugUCWc2B4AIbAgFACRAR
-        WzrxqtPtusB0IAQZAQgAHRYhBAUi3Sm5jxZ82EIXUuOP/K91q9kqBQJZzYHgAAoJ
-        EOOP/K91q9kqlHcH+wbvD14ITYDMfgIfy67O4Qcmgf1qzGXhpsABz/i/EPgRD990
-        eNBI0YGuvoKRJfetEGn7LerrrCB8Z+ICFPHFrzXoe10zm+QTREck0OB8nPFRycJ+
-        Fbl6JX+cnkEx27Mmg1aVb7+H5LMDaWO1KjLsg2wIDo/jrDfW7NoZzy4XTd7jFCOt
-        4fftL/dhiujQmhLzugZXCxRISOVdmgilDJQoTz1sEm34ida98JFjdzSgkUvJ/pFT
-        Z21ThCNxlUf01Hr2Pdcg1e2/97sZocMFTY2JKwmiW2LG3B05/VrRtdvsCVj8G49c
-        oxgPPKty+m71ovAXdS/CvVqE7TefCplsYJ1dV3abwwf/Xl2SxzbAKbrYMgZfdGzp
-        Pg2u6982WvfGIVfjFJh9veHZAbfkPcjdAD2Xe67Y4BeKG2OQQqeOY2y+81A7Paeh
-        gHzbFHJG/4RjqB66efrZAg4DgIdbr4oyMoUJVVsl0wfYSIvnd4kvWXYICVwk53HL
-        A3wIowZAsJ1LT2byAKbUzayLzTekrTzGcwQkg2XT798ev2QuR5Ki5x8MULBFX4Lh
-        d03+uGOxjhNPQD6DAAHCQLaXQhaGuyMgt5hDt0nF3yuw3Eg4Ygcbtm24rZXOHJc9
-        bDKeRiWZz1dIyYYVJmHSQwOVXkAwJlF1sIgy/jQYeOgFDKq20x86WulkvsUtBoaZ
-        Jg==
-        =TKlF
+        lQdGBF2QYYMBEACrIy5plkXAGvh95RWhPhN2JVnBkcIuflojdsdOzqbrm4nMmkqc
+        qU8XHcz6+MhqBH370XIW3QxJ2RXQEz6ycHGNkM8PFPP8uFPE8O1zEUdIT5+j000V
+        MoNdKBhxwvloMCjaMrYBBCcpd5eJclSsg8d9TOxYDnjlVWzOQuFhQ7bFmTGKaD5X
+        RPG/73VN6HqfqtnIgzVTcOLYZc2pFAfxLpVMAg/igXdxgpp8ooovKzrHC4a6WkvJ
+        CsYUksu2P2CbRZcahvJnbf5x7dXdfzPrzu4ZidnLtIq694+bDuJ2nhxL/9775utW
+        4i1ExziEq8xdndz/EKlY1fowLEPA2wuB5VqtR2choY1FjwSMQiPL/dJEFIBwOJeN
+        morQNhsPRzdM7LUXmU7SblYQYJTuBnZbFUHCBRA2rAGFwWAJe9f8wDqDH2Y3oHpk
+        bPE1LAzIW2BF56otWfYYyL3IxxjyDJsEPbN9JPJ9LpGdco/UqLe6sZFaDGhRnOpq
+        v7tyMVKkX42sGHRp6CB+2g3SjQWGbx3ebNN8pFoIHsHYJXIu3FhygbAZi67jLUA7
+        O/uyLpy9jNaGwQTHJEcv/FwBA8pcKVwGniahgsDCfLNiQDQxagXEwILEie0pLROE
+        UtaXwe0Fv8KbbEFRY4NKuIKYzc2R5YknRsfoiG82ikPZA2P4wj/Gu+H7GQARAQAB
+        /gcDAhdgTwPLD6FW5xos1L485Zm6eFl7JRpKMiNDswBXHYyv73yZDcHdkYuOXBKN
+        p2LumGgPeIBhWo/Ui07KPrkOhYBqgGvn10qyKaCtqCvEkJClzG+mdIZQNUyi7FRy
+        37K/gmkx3rZJF6ftcCA6YU4YeZ8dbj9hdfmjXoQhZWXBz1CBD94J6wVgmscAYwJe
+        1K+KazcJo3IQdLTfZAuM3f9FGPGW3ZIFiMt0pRJZhWwvtPYmgAeiMqkuQTxev9sb
+        AUQ+WhRXcm+VJqbSyC3wjuW4wmRMqJdwT+Ahpz+qkRtluiHNqQZKvKl1cvaNZbxk
+        6tm0N4OcuT31TJfxn4CfXqlUeKkEgtR3pL71PWd1Zo+MaLFjXTbzvD9epZtvDD3r
+        f924H5qYM/DNpRXK5/ivF7PQHW5FMQ77o93StjIN0iYWx0XXDcCSJNQr2+ITFLJs
+        Qr66N8y5JgZ++h44WUAZA3SiyV7OqdIqhO9CPYGgB00wbJszgH02ZhtE5c2dCGL1
+        nbRuog0kUkp8YmPm4Psoq81AVY/hmGVj4cQSqEEVA5gih1mju0C2Q9i8K14IS0zm
+        /wA4woglp+w7uUwyN882d685943HheP/LpRd+uip4iIfoc2o+WU98egUB+6/OsfC
+        qgeE6bO5TS/nZuEqgai2NN/Dg03aMyjF2wouD/5b4+3Ngw8UdLszxVsmOWzOtxaB
+        aOm5oVp3Uc9qii8n079HhreSu1MdxV9rInIMRrrQCj7umS1mPvPZrHsFLpxX+Go1
+        gjz5g67CZB58YyZf/1iE9TmY5ptXhxrgkALc8YJWABkMCKCiTyVccILEUB0GQAMz
+        EhULDUO1u5vide25ob/CAHcuA5AtjY2hlZNNEocGNBS0hSVXhKc/hyjysf3QUacY
+        V0/MNUEK04ij+v1Pi6C634uapPIIE6bJmf3bjiCy58ioR3uA2JF1fEmQZ60M1Z6s
+        dSesdN3ZupxUtBH4gzWMmViA3dRCQKqGSfekMORC/pojtdXhkKvBbOqDJpja0zAU
+        IqCarX7HVMAYzwYqG+ElKOihgN1229bTi12+ahaapQvdu7JNnJfZrsk2wYRxcxuG
+        h2V5FhEk1/FDOHL4yNrqL3eFns0HKKTChR4h1rzZkXwm0xDG9dwleJzz5CVTJGvd
+        vI9u4Mkk1/OVnDs9DHkzsfeReNcdepinW4HK4oFCPYYB9NgSySxxMOIEFLhNl4q6
+        re2Js9TkqDrWtEdHIW+hty8uhzk2Xeh1c23L5XiivmEnD74PcQbpTQ3Dvp0hvTzo
+        qhUC6+1KezUeOJD8IRBti8pxgZkBPnhvzUmxEiRWmviUHzCppmOxUT7X/8jb5PNi
+        jOOxtBXgIhLiw2dtCGcTL1kBGn+6cjOcBujXGPkoJEi6w0vLF5Cq+3jt/3P5Gfta
+        nTnBs8bNBvIUpwrtyvBYy/k/6B9xIqEi7Afomaspi0Owz9+MtXWaQrnL6l8OXU5P
+        XLS95c5Yl95Crj949oNzuH2yuJ3eXGac7/i3KcJwtWltFP4yLcS24SZlFhVFQMUI
+        GUZrTxPDOkn28cBcQvDtbU9eA7O5Y93N52HwQVR2LyjdbND3tpGQObG/YpvqVSOe
+        q/9IAT8k5wZ4XYB5EBukWGNZ/z01OJpaPa73cXN2IiLZvkFEeRIEVmaxD7fSYfTy
+        ygjxz6Pum/3TrJ0CjubZfQRjwJrI5fAMoEbMGKE0oboucBPawLnNIecy07jo1ixM
+        4Q7kzrodMrRQ4YvsLdNB8J06a+FNQWeTWeNXJcczNJWDNhqUK2QWHnq0H0pvaG4g
+        RG9lIDxqb2huLmRvZUBleGFtcGxlLmNvbT6JAk4EEwEIADgWIQTCl0Q4xqj6zDNx
+        KR0oWVAhYzyEIQUCXZBhgwIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAo
+        WVAhYzyEIU+4D/9iAtghVlUS387RClem6BDDITBqR7yiBUmYNB69xTnif97Q2tww
+        vvC9WPfZfD43ZzZoqxs8ztIWplEIStO0IstpQUBOxR99x67LjoInBbc9yI9MIJrC
+        V1gLwdYctMU15+uJvyFjnN9JyhCg4ZOdRENaHtaWdpPP7Z1T9pcqm1WHhbodbpgm
+        Ni3o2uuPuRTCXgE2PPInLS4zshYXLB4V97soO4V/Q3doKXXJ7aPP5Uh3CKpRobyy
+        rtWhYdzGOl5ca7rgkktqLTW05W7OpA35jEQa7AgjErNZMoJUi7zIFRvSbn3pcr/x
+        raw5sraQTqyHTU2IYvSA33GtrHse2clN+WDKhHXJC8UHiq/szHj77ATwk5UQ3WpW
+        xH6Kk6ECidYz7e4VexSFmLGzttM6BXnAk4t7YkMIU115ghYFR70Uyv7AXWL5hFjI
+        Ccw9S9vahODi3adG/5QX20wE+wOL5ktGqcWxQ9p67avRY8sgiYtbqhaBoPzaCm4F
+        zk4I1VLwb4XnoIuTz2Dl2gLT/A5/rdIqQiub7+PG4aSeH/2Qe9vZtur8CDSNndFE
+        tSLszjzPKylP3xp37Y+SgB0QATZ3Ww7OUYLEefXbI8v2GDEyc/VRYzHuTYt2aQ53
+        7vb9wyJhHQy9oQIBfYaPwsMlCjynZL7fl5J3pSozb/NllP5h7A/jHmUZSp0HRgRd
+        kGGDARAAzjsHpSEsJYZn8Pye1a15gKzM2kV+BfK+dJdRFviRLfeX6e54eWVnrB75
+        uWtQIfXawzIaeNjTaRgUOW6JrdEsDoEmTnP2bqgoDHZPfocm7VoQHTODspQJW28L
+        O0TeNHEFXQb2STfzOAe3COqJab6XhQ79/q60mNZiZNQcwh9MvCmcDzNQqE7V2V/z
+        M2VOu9DF70YaGhE+mayGxrTzsssx/Sdo2YjaE3FuVb68/+Wk8HEoBupQmJYMLsFf
+        ccWDc19H2WyBZp5iTtN21UrEfacfOWGxBmpcPmHP5D0Nb/tvWmTVbktoW/0MRCH+
+        VAanm5uyLL1QeuEuxNcIqTnscg7KIoXLaZMbeAPY/+DjJrjcIojsriopC/f7UMDP
+        NIurbzEztO/RvQzKCr3Asr3RJW6Ql5L1zaW0o+JCz7h06+vYSn6scpKG55yrA5av
+        RqKQP+7i8AxCDWORINZ2Z8ckpvh0HsOlIXTwLUKwuvjvoRul3RH/zqpLOc/t8hil
+        wpH75Zg73S9tIGGfQwW3kzlCR7iNUloB9QfDN1T1aQ/kuOeFjmkG8fjh+UVkwxzh
+        cHZwg5pT7kS1g7iwTkF4+EBPdIEGpB5EsvupJbnZkPOUS8eTU8hVSCLFk4x1v6W9
+        pWFHyBMcspU0IU9eq0mLte4LKfZHK4cCGuMi3vyMShg4qDOVye0AEQEAAf4HAwKr
+        FFKdQyXE9OdLh7w0owYE1piq8TicrWLjclS9DoEkM4jpPJZ6nhNjJlLxgB9LxyWQ
+        vKT50xd6Yhu2z/c4NUSbMFXaYLuYsx21mu5Bc7DASjr3cB06cBolaYRBjCOhhD6h
+        6ujnXxj/mxgkQBX7NN7CRSEtkFwMVaLGCaNo+r/BC17Ich0jzBxPKTkEnjjB9oNU
+        bYPJqmzKnr/PRynZrCg6wQ5n3LsPaiYisUydeuh6kLDJDpk4e+wzFBHslqpRDDoD
+        diVuMrWCWcWpzHx908YCql+0zf/0KZZ61Q0EuoUz6610AFWTmfXj0qLI9fG/JfYD
+        s1I4al44PEia6lO+impf5FaZqktFZfivz+G+d244xpck06kkyKH6OVHL84+eA/oi
+        x8aJ4vGdAKzEbYix52nMzWVbWqHEgTTNuShsErwpMI8FGx0rWufTc+E8DPnKnsoH
+        CVCbF1TooGZBW0cYfzbi0VhAIVAg/h+6KyxaA6RucUCvmiynvSwvKXKlk9uwpEoo
+        F3zKB6/EMd3pxlAM9TSqii2Tm63WPz2SWkUvV0WYqftuND9K907ZSTsQf+W4vfKy
+        VKsuwbKzfrg4ggDwwuj6T5IQVKT4eTVBE/5XhLlkNkhMAXjwgugnJGnsJ+M+Un/I
+        j8D5nOsTiYS6QIyobMSa/gNavcOMbZR8N4h9wY68doMztSEvvCCHyIJGdDtp15ZP
+        ebYvHlgyxkVCgb/1HmuniGvSw8zEOcJdTx/fO8Fb+Je4Ih/yjWYkFj+3BmvylaoG
+        fQUaFG6rf1x1WzCKAnHZlratN3Hq7vLDLXDbjXRRdY2FsCJpX2a+ptLZHNPdSa/y
+        sy98ut2TdZUE4b1wzLMNCxqUf19sapJ7ZEIk+IFBxvsL/u+EYoMpICOiz0JOb+1w
+        bzfAmj3SOaZTdZaUk0EZPoXxA54QVovvONYlhC4tuJnoKsNJ6IStMNd4ojrYSZAo
+        xzFU12Y1dXcW/EjKpUdc4q6t80/1VQsqIFvTwDeKRq4J9xaW8xTfecPCVYOacNRZ
+        6363vaoQuLSIhrvrL/lPTx4veERaDj6UkBuH6EIyE1q/sTEbs9e63CcSTw7Gmqq8
+        ZVIQT4bl/Zg7/77Jg/Cw5hU7m6rWaBQDHlJjxkt8mA+q4E0uOQkA9MoE/6tbUssc
+        cwwesfwiID898lQJPtsE1Ne4I9UrKjR0tzf+/m+p9vJjRLHClMosmCgIRPoy4tk9
+        vTLi+uYPggtxIibblWQem4knWP1q2w7Xu5ycGIiMXRxoYIQVkefBHWZSVSPJ6WkF
+        Cwb/K+gE5ep4/irzD1OvwQFmz1HwzoarAsIm9kzhQg5ftis+n1DbrLyf2CGdXd61
+        FGo/NKzA+3ONsK1gyKPiOFJzzccT05OcF3boD18QpiOnwyjjntipNg7e/fAmCHB/
+        IqO2cXWhAa//3Cxvjj7c9erY2cuPA2CRcjpSr6mht2hP4jkDaAK7UMXrXvlJQJ2O
+        TMGJRmAspsVa36CoIhUTJ+bVwd0M4H3ty34QmCKjEc+efPj7X21h9zJcNLsrTNSk
+        XIuYelWoanmW9d9//OBAXdYUy3AqH/tspROFLTaWYWpN1VIHvn60dJSYn397MlcZ
+        oM7x6Zilu41sSHDQzCi0oPiGReDlDfdNZjbCqBFHhNVO6SDq/A/XX6jVPlcjaOKJ
+        tvYU2X9cH6YBag4+KJqBq1CdEIjEKgzB6QKwY51fVOh5asAbNC2pqEKeZKfej8RQ
+        uwyGLvrZOLPTY39I2x+OULGh5HfUZUo+K5/G063XZn8peH+FiQI2BBgBCAAgFiEE
+        wpdEOMao+swzcSkdKFlQIWM8hCEFAl2QYYMCGwwACgkQKFlQIWM8hCFSoQ/7BYzi
+        pVu8Z4rScxlDnJo1iFHckHW7rmMngE7norQiq3Hqzbs36maOL48/sOfdSBfwUDT/
+        RsUuW6H8sOXV9cuFZKwRWlgcFqt7g1BUCpc+D2RCKMQaEhUGmtmZQFU807sCYGqL
+        j6EHWpMJoFgkmtbac19ZqH0OvtqGlnRXnNgETCVc8iCPiQEYful2PpNt9mdHDr6L
+        EjL7DQoepdgKMQC6r1QeNeHwuLEdNAIqTzPqdM+UlGxTtIbDSiBRa8WD1PIPwEDq
+        eHFFcR3LK5yY9WLzbOyo6cAwa/dPHYL3HpizgmY+MrxiopHzNxcFIqF9bU2j0Tia
+        7h/N58sdGkr3ml67NDOl9pjgEPEj2rEGVApyOI46l9Mf9v/TrO1Kg9N/FNKUzArr
+        +FWK1L5JK0WkceupsiYBm9pbgWUu97sg+t7JBPXH7Gn5gNNqZRDiam0YUm5WAOpF
+        ONn4FrVwzZcv6Rs29qiadvCuS9sPdaDJgakliQbGL6f5vvEaRQ/F7Vmc91aqFUDx
+        TXzfRujIBKLOKoBN1xgh4ElGTLgRU+E9TuQC+Wk6m+dsuG9EtFsjMgUfBriJjw69
+        H/5nv5yFiIuQSVX9fvCl3QO1fiXvMyY9FXfRy+nRi6fuAYuqmKcNiRLXnCYwWJDp
+        /UgXnDqgSSXAe3f4552KPbxVtRGLCdk1dztjxbCdB0YEXZBkDQEQALOViZavAJFG
+        pwEb8dN85K1g8zHuHYh9kbok0iP5q9KlMf/NltbejuR7+T5LLIBk4dZsHzeFTIBf
+        rXYpbmV8QmS76ULdEyGsU4SssrDzHgLRmsLVA7xpoWKomo4imsSoS/gBlQya1yGu
+        gDCCU4hyk7zY4xbQOkuTPWCeVQdhyXcIe6QAGGj15Wplg81rfyZgK7Nudf+FunRu
+        livqEpWXmdoamvdlax0Y/4a4xvadtcVRxMPH3bk4FzYjXKheQczTv02PyKv/iOt0
+        qDbETbfUf/OEfEk/4MNE++ukLxhNF80HaHg/Wf0NW5MCrT150/dPGTHCvpIr9MJH
+        PssgaSIr9K8K0vTJoDVsKTv+PdFJ5ELBdDqlUsk/AHajGp1cnXZVlWyGSaUdkz19
+        8xxSm1C5agGRGgO+TAvILRWHEYpxoT26lb1jJ7m7qEuU8+b1k8Bjh48tMwKQNkwx
+        f3j+TQW3b9lGo/ikV/E6NtkVpBBEmuX9LkNNzOErffFLG/bM7CsdBhTZbQaZqueR
+        I6RG3QzT4jqGfmN2SCnHOlz4TRPTvOo7casdyjU4FrqZni8k6IQNVcwhl48mDUht
+        Brg0sJlNhE/SXFHz6TzDHo3hw4iTjfpaNDm3icc/C/XYIccmsvazs0OOP+PtXx99
+        Ph9B+symlnxuDGx7yM8ewF3t05Ye2kAnABEBAAH+BwMC2s4YdfzUovfnEr95gTA9
+        GyCSMONbAdWew20r6OPdVDUNOHfsHSdtkCgLI+RUcgO02sFyNygdozGj4SYowQSY
+        YzOgUoUI4w3NKDojS7f1LMP+PQL/1+oG/koo2FNay131KnaZauNmYYzubUUJxPGG
+        sVH9Var4D2DPCzWcpRlhxXC7mIX3YPB51hjlHSE9QiJPGNwqri6LTaq31Ypo68K9
+        YqWU57WKxJR3YnJ6yrHFAhuPEubjy/lIAfcgClYncaHEbH19Sq+Nbe/LFq5nhbvm
+        UcVA4MjoZalF7wjLnQRZW6oC+NY6yTx52bIjNCcreP4pD/Q6bP+xEDBe4ISIAlNp
+        tYXFq4o+EVP2gTa1yoWlAgXHg9b4ML9Gc+7NBEzrZlQMDUDzjG30FlzBA3Gi8Dmc
+        rSo3a7MOqzg+QcuZvHfS9FH0s8NlglHqC28t/5lM9IfWaxQxv8u4+5up8GbVYvKx
+        HXl9Qd450ibBwKhOpLlGHVZMTe1ju925XCMwCFoOPxO/QhAaCFnkPjda4KFOD3rB
+        PuToKyGfJ6Fs0lO2OjgNxXCYLTWpkxietVh1Ff8GFAZ9QsGl8nJ2gAJzqFDnPZBU
+        4hXI/3mav5aNo3b/avRuzIFxuZbAUFAHbwcTwOXxYt1Xc1mivlyt/P27sCWGaOV5
+        4W/vJ6OFdoYtzNsGzIo3VqQVSUwcQtMC7cqLlLk6zcyxSdIO+1bsg/x50MyNCZYh
+        q3/KVfYHu13Jry2bNQSwCZE88U+KEXDSsWcRS53El6P+gsy+XHCtOEst+qJE30kK
+        /LdVaKU8Xlpfy3CuiWyPM5nELWQ4wqUke5XwhUOl+o/CCG0A8q+Fj3y2Vw9/f1bx
+        yZ0axxaFa8+LdQScfw406g9hF9tY4qHx1xlO783dhI/MBhszfyUVnNXytLTaX7SX
+        YtvOzYV+2GxIAQRt9NC332yWAw4tOCIuAMibv1ZWrGaMWdNIuk3z3zXkZ/YyR3nx
+        7mdiOivzD8Eba2eg6pLP6lLTDfGFTSdUaUc1LHMz3kl0dZNLqFwJcLRrpEfpQo+C
+        XbbKxjd1nQzVtNA0BdG2bvGyfNDhwlgWkROIpmu/KX7ZTTz55ahl2qSBvH9XCaKl
+        8sU8E7QD13MAqvUgVX8v9vA5Q80bQNsXjpDbBr+pN54UiXrGRyIQuektQLBM0KRQ
+        ozfmAFzk9PHw6udqRlr5nOgkWYd/kMTWCuK1l5yKhWexMO1WvZ4iC0u5I0a0PYK/
+        zSVhsME8FGeJ+74+lJ0zxa7klo40R6F/zW3jVvnVjG/evKcztPXd2lVm2h7sdQd2
+        SgOBAzLTMOCw8bU9wIDAJ2QwsGJyVG/rBzeoFySPvw/IxrGh4QM7hiuFKg36hmPP
+        2SAKyLCUgXLT+hZ+Shr0NT7BXnfN0LaEUKvmsTSQ4QYL05SbTh1p2YF9ZrEQDvmu
+        o5sIw9YdSqRpw0rH4+TtQ+9waZ7K3+CrwFnANG4oVMi+zkcC4OYmOSa7UWjxTRtl
+        IMbNJL9ef4zhg01BFckGDRqSSzs1Z7brHsNhsd2Al69CYc8nEbPVKhuo7X9MGeAJ
+        R7tTKZwhXm6t4YAJKs41F6H+tIsF2UM5uKdigUpd5h5nMva17eqps80uuusxJVsy
+        EIiVV7UpO5mlIJc7n/urbizNhI5UDcMkji16htc3iOzzgu77dCkf3Kl4VMWx4c0z
+        1WNodx3UuVrph0xgaHg/CX5Ss+f2CuLGwbJ+XyGKex2rRWpdq3r/lgm/ihAXG+j7
+        eOk61duFlb6nk/G4mVSnRodKGHHvYokEbAQYAQgAIBYhBMKXRDjGqPrMM3EpHShZ
+        UCFjPIQhBQJdkGQNAhsCAkAJEChZUCFjPIQhwXQgBBkBCAAdFiEEOtBpdPeN0WA9
+        XkYX0JVdIvLDJOIFAl2QZA0ACgkQ0JVdIvLDJOJHCQ//dYB0OuwIgtSLLMuBnxjB
+        uwEA27Fj5iL+gBr22vpbYtWgUvfkAa9s/qm/Z2tL2xJE/HN+eRO9AXBu3dWQeMPE
+        Wamd00eQktTFFpjqAOeeOCFRbCbRlWreAy4ES480IakHeOk9fNEnOCPqgtC/UdWI
+        G+HqhDCPOVaaa3zyqrGLx/+6ihdL9ztIuNoYW1l1pXfNSPJxp9HGiQvGhuL/+34D
+        Q7Hv5W0SYKS6jTqreFAOkQdsfNenzQk6YFm7TbhycAVH7IkjsX0s5EqLZpCZssHh
+        5hmm14GLkbGUy3fGFLTSg5uI92ZDdjJQYpUixIis/mPbDbQ7p3rOQayxVdDpzyCf
+        PNks5kAfHFj0lGOxOb3eEZUXxKcbP5QgqjTOWmNaQRnLN0ZUfZICt4m/t3VvuGmo
+        O66IH7b2F6iMpzO+BH9RqDGKkBkfgdeqkVSrIXW/og3dsccfAewcCjij3hRyMnr4
+        wwEBL4CJAFYoagtPdEOp9IAVZaAXh98nQL2X1y1/MSbzZT9hH7vDjYh8wpAYxbR5
+        nxZWILDI9ZP2JE2C9PWpDzupwYLgkJ/L0d/kpW93c5raSXInOB4hVUGUaGtqpJB1
+        aeuzTrs6Rb+2Py8ECbFn4SH7c0OJrlPoRhWTvu/g7z4Lhe+mNHoNSfJc3hkzmTRr
+        spknQfIRKmvOqc5BMGQAg8g1Wg//YVPK997C73rPEL2/syAQtn3oINtHLLsgx0fn
+        +pGV+BDl1aEdaTlF5kBprYAOC6oZQxnEbH+FlZ7ad6GanvRwY0/HiAo5WmIH0u5N
+        AcezTnppwX150Zs5rRBH0fbT/+I6CNYoEyGfX5yBmMhfc1gbS+il+Z68yiXoJ6Tk
+        ht/8PqHePj5u7ySJiiG1fEn7X8f1WjmHKuyUqauX6jOUGsIaO3q5NshUiIhhydbu
+        zgrnAS0JXdjc4rrGUxscI5QU0Hqj3hkvczeDeMrNEwBTbDaB9aNvHbYP+L3y7BUo
+        pgLJkP7ObZzcS0uFcv+STDKKAgKFoqoStZN35/3jXuar+d68aVObKDr5tbKGT6w7
+        EeUPkqqLolKxUyDDHO5YXchMJw8SpVc+GenC4kx1JPqnPbJSsvRgZPP6t3AJFh4G
+        cTCV9wIPO/YIBrFZHGgKB58u9XWjIJ0tdOvvdGrrugazh2Zn8ymOL80ENTSe75Ds
+        IJlZSj4AAI/vDB16voU9nQi/XoOvfizw6tm1frkReFyr9/gC3qqnc52u6I6VMsGk
+        hSkRYIoLAwpF+XysGp8ho707Gf38RnHOxemSjelz6JZDx65wI+B1KJDNCFHxQ3ky
+        3sah9AQbzUVN3Mi1kKkB7jXOqMMlZs0hf22Yembi+Bu7rmDr/adQN4wqXHHNIYEd
+        2/h4D2Y=
+        =NmAP
        -----END PGP PRIVATE KEY BLOCK-----
      SECRET
    end

    def fingerprint
-      'EA3F8B88972A8FD474872F2F115B3AF1AAD3EDBA'
+      'C2974438C6A8FACC3371291D28595021633C8421'
    end

    def subkey_fingerprints
-      %w(159AD5DDF199591D67D2B87AA3CEC5C0A7C270EC 0522DD29B98F167CD8421752E38FFCAF75ABD92A)
+      %w(65A33805A5DDA7454190EE536F0E46B850B18E99 3AD06974F78DD1603D5E4617D0955D22F2C324E2)
    end

    def names
--- a/spec/support/helpers/project_helpers.rb
+++ b/spec/support/helpers/project_helpers.rb
@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module ProjectHelpers
+  # @params target [Project] membership target
+  # @params membership [Symbol] accepts the membership levels :guest, :reporter...
+  #                             and phony levels :non_member and :anonymous
+  def create_user_from_membership(target, membership)
+    case membership
+    when :anonymous
+      nil
+    when :non_member
+      create(:user, name: membership)
+    else
+      create(:user, name: membership).tap { |u| target.add_user(u, membership) }
+    end
+  end
+
+  def update_feature_access_level(project, access_level)
+    project.update!(
+      repository_access_level: access_level,
+      merge_requests_access_level: access_level,
+      builds_access_level: access_level
+    )
+  end
+end
--- a/spec/support/shared_contexts/policies/project_policy_table_shared_context.rb
+++ b/spec/support/shared_contexts/policies/project_policy_table_shared_context.rb
@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+RSpec.shared_context 'ProjectPolicyTable context' do
+  using RSpec::Parameterized::TableSyntax
+
+  # rubocop:disable Metrics/AbcSize
+  def permission_table_for_reporter_feature_access
+    :public   | :enabled  | :reporter   | 1
+    :public   | :enabled  | :guest      | 1
+    :public   | :enabled  | :non_member | 1
+    :public   | :enabled  | :anonymous  | 1
+
+    :public   | :private  | :reporter   | 1
+    :public   | :private  | :guest      | 0
+    :public   | :private  | :non_member | 0
+    :public   | :private  | :anonymous  | 0
+
+    :public   | :disabled | :reporter   | 0
+    :public   | :disabled | :guest      | 0
+    :public   | :disabled | :non_member | 0
+    :public   | :disabled | :anonymous  | 0
+
+    :internal | :enabled  | :reporter   | 1
+    :internal | :enabled  | :guest      | 1
+    :internal | :enabled  | :non_member | 1
+    :internal | :enabled  | :anonymous  | 0
+
+    :internal | :private  | :reporter   | 1
+    :internal | :private  | :guest      | 0
+    :internal | :private  | :non_member | 0
+    :internal | :private  | :anonymous  | 0
+
+    :internal | :disabled | :reporter   | 0
+    :internal | :disabled | :guest      | 0
+    :internal | :disabled | :non_member | 0
+    :internal | :disabled | :anonymous  | 0
+
+    :private  | :enabled  | :reporter   | 1
+    :private  | :enabled  | :guest      | 1
+    :private  | :enabled  | :non_member | 0
+    :private  | :enabled  | :anonymous  | 0
+
+    :private  | :private  | :reporter   | 1
+    :private  | :private  | :guest      | 0
+    :private  | :private  | :non_member | 0
+    :private  | :private  | :anonymous  | 0
+
+    :private  | :disabled | :reporter   | 0
+    :private  | :disabled | :guest      | 0
+    :private  | :disabled | :non_member | 0
+    :private  | :disabled | :anonymous  | 0
+  end
+
+  def permission_table_for_guest_feature_access
+    :public   | :enabled  | :reporter   | 1
+    :public   | :enabled  | :guest      | 1
+    :public   | :enabled  | :non_member | 1
+    :public   | :enabled  | :anonymous  | 1
+
+    :public   | :private  | :reporter   | 1
+    :public   | :private  | :guest      | 1
+    :public   | :private  | :non_member | 0
+    :public   | :private  | :anonymous  | 0
+
+    :public   | :disabled | :reporter   | 0
+    :public   | :disabled | :guest      | 0
+    :public   | :disabled | :non_member | 0
+    :public   | :disabled | :anonymous  | 0
+
+    :internal | :enabled  | :reporter   | 1
+    :internal | :enabled  | :guest      | 1
+    :internal | :enabled  | :non_member | 1
+    :internal | :enabled  | :anonymous  | 0
+
+    :internal | :private  | :reporter   | 1
+    :internal | :private  | :guest      | 1
+    :internal | :private  | :non_member | 0
+    :internal | :private  | :anonymous  | 0
+
+    :internal | :disabled | :reporter   | 0
+    :internal | :disabled | :guest      | 0
+    :internal | :disabled | :non_member | 0
+    :internal | :disabled | :anonymous  | 0
+
+    :private  | :enabled  | :reporter   | 1
+    :private  | :enabled  | :guest      | 1
+    :private  | :enabled  | :non_member | 0
+    :private  | :enabled  | :anonymous  | 0
+
+    :private  | :private  | :reporter   | 1
+    :private  | :private  | :guest      | 1
+    :private  | :private  | :non_member | 0
+    :private  | :private  | :anonymous  | 0
+
+    :private  | :disabled | :reporter   | 0
+    :private  | :disabled | :guest      | 0
+    :private  | :disabled | :non_member | 0
+    :private  | :disabled | :anonymous  | 0
+  end
+
+  def permission_table_for_project_access
+    :public   | :reporter   | 1
+    :public   | :guest      | 1
+    :public   | :non_member | 1
+    :public   | :anonymous  | 1
+
+    :internal | :reporter   | 1
+    :internal | :guest      | 1
+    :internal | :non_member | 1
+    :internal | :anonymous  | 0
+
+    :private  | :reporter   | 1
+    :private  | :guest      | 1
+    :private  | :non_member | 0
+    :private  | :anonymous  | 0
+  end
+  # rubocop:enable Metrics/AbcSize
+end
 @ -1 +1 @@
 .1.12
 .1.13