code: func signURL(c context.Context, gsPath string, signer *signer, expiry time.Duration) (string, error) {
  	// See https://cloud.google.com/storage/docs/access-control/signed-urls.
  	//
  	// Basically, we sign a specially crafted multi-line string that encodes
  	// expected parameters of the request. During the actual request, Google
  	// Storage backend will construct the same string and verify that the provided
  	// signature matches it.
  
  	expires := fmt.Sprintf("%d", clock.Now(c).Add(expiry).Unix())
  
  	buf := &bytes.Buffer{}
  	fmt.Fprintf(buf, "GET\n")
  	fmt.Fprintf(buf, "\n") // expected value of 'Content-MD5' header, not used
  	fmt.Fprintf(buf, "\n") // expected value of 'Content-Type' header, not used
  	fmt.Fprintf(buf, "%s\n", expires)
  	fmt.Fprintf(buf, "%s", gsPath)
  
  	_, sig, err := signer.SignBytes(c, buf.Bytes())
  	if err != nil {
  		return "", errors.Annotate(err, "signBytes call failed").Err()
  	}
  
  	u := url.URL{
  		Scheme: "https",
  		Host:   "storage.googleapis.com",
  		Path:   gsPath,
  		RawQuery: (url.Values{
  			"GoogleAccessId": {signer.Email},
  			"Expires":        {expires},
  			"Signature":      {base64.StdEncoding.EncodeToString(sig)},
  		}).Encode(),
  	}
  	return u.String(), nil
  }
docs: // signURL generates a signed GS URL using the signer.