Fleet can already hand out signed download URLs so clients fetch software
installer and in-house app packages directly from object storage instead of
streaming the bytes through the Fleet server. That path was AWS-only: it relied
on CloudFront URL signing, which has no Google Cloud Storage equivalent. On a
GCS-backed deployment, downloads always proxied through Fleet.
This adds a GCS counterpart. When the new `s3_software_installers_signed_url`
option is enabled, the S3 store returns a SigV4 presigned GET URL generated
locally from its own credentials (no call to the bucket), pointing directly at
the GCS endpoint. The signing logic prefers an existing CloudFront signer when
configured and otherwise falls back to presigning; behavior is unchanged for
deployments using neither.
The option is gated and validated at startup to require a GCS
(storage.googleapis.com) endpoint, so it fails fast rather than silently
proxying large files on an unsupported backend.
7-1337
c7dabdc939