code: func (client *clientImpl) remoteFetchInstance(ctx context.Context, pin common.Pin, output io.WriteSeeker) (err error) {
  	startTS := clock.Now(ctx)
  	defer func() {
  		if err != nil {
  			logging.Errorf(ctx, "cipd: failed to fetch %s - %s", pin, err)
  		} else {
  			logging.Infof(ctx, "cipd: successfully fetched %s in %.1fs", pin, clock.Now(ctx).Sub(startTS).Seconds())
  		}
  	}()
  
  	objRef := common.InstanceIDToObjectRef(pin.InstanceID)
  
  	logging.Infof(ctx, "cipd: resolving fetch URL for %s", pin)
  	resp, err := client.repo.GetInstanceURL(ctx, &api.GetInstanceURLRequest{
  		Package:  pin.PackageName,
  		Instance: objRef,
  	}, expectedCodes)
  	if err != nil {
  		return humanErr(err)
  	}
  
  	hash := common.MustNewHash(objRef.HashAlgo)
  	if err = client.storage.download(ctx, resp.SignedUrl, output, hash); err != nil {
  		return
  	}
  
  	// Make sure we fetched what we've asked for.
  	if digest := common.HexDigest(hash); objRef.HexDigest != digest {
  		err = fmt.Errorf("package hash mismatch: expecting %q, got %q", objRef.HexDigest, digest)
  	}
  	return
  }
docs: // remoteFetchInstance fetches the package file into 'output' and verifies its
  // hash along the way. Assumes 'pin' is already validated.