**Related issue:** Resolves#49553
## Summary
When `s3_software_installers_signed_url` is enabled, Fleet returns a GCS
SigV4 presigned URL for software installer, in-house app, and bootstrap
package downloads, so clients fetch directly from GCS instead of
streaming through the Fleet server. This unblocks packages over 50MB on
GCP Cloud Run over HTTP1, while keeping live query working. Startup
validation requires a GCS endpoint and HMAC credentials, and rejects
combining the option with GCS IAM auth. Builds on community PR #47729
with review fixes.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
### Manual testing steps
- [x] Confirm GCS parses our presigned URL format. A live GET with a
wrong secret returned `SignatureDoesNotMatch`, so GCS reached signature
validation.
- [x] Full round-trip against live GCS with real HMAC credentials:
upload, presign, and download. GCS returned HTTP 200 with the exact
bytes.
- [x] On a GCS-backed premium instance, installed a package on a host.
Orbit received a `storage.googleapis.com` presigned URL and the host
downloaded the package straight from the bucket.
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added support for delivering software installers, in-house apps, and
bootstrap packages through Google Cloud Storage presigned URLs.
* Downloads can be served directly from cloud storage instead of through
the Fleet server.
* **Improvements**
* Added validation for supported endpoints and authentication settings.
* Improved URL generation across supported signing methods.
* Downloads fall back to Fleet URLs when signing cannot be completed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
George Karr
bc537a37d3