GCS signed URLs die with SignatureDoesNotMatch days before expiry
This is by design, not a bug in your code: Google rotates the managed signing keys, so do not generate long-lived signed URLs once and store them. Either refresh them on a schedule (e.g. a scheduled Cloud Function that regenerates URLs every ~160 hours, under the 7-day v4 max), or sign with a user-m…