GCS SignedURL with Google AppEngine Standard (1st gen)

export PROJECT_ID=`gcloud config get-value core/project`
export DEST_BUCKET=$PROJECT_ID-gcs-test
gsutil mb gs://$DEST_BUCKET

gsutil iam ch serviceAccount:$PROJECT_ID@appspot.gserviceaccount.com:objectCreator,objectViewer gs://$DEST_BUCKET

$ echo bar > foo.txt
$ gsutil cp foo.txt gs://DEST_BUCKET/

virtualenv env
source env/bin/activate
pip install -r requirements.txt -t lib
deactivate
rm -rf env

$ gcloud app deploy app.yaml --version test --no-promote -q
target version:  [test]
target url:      [https://test-dot-yourproject.appspot.com]

$ curl -s https://test-dot-yourproject.appspot.com/
{"url": "yoursignedurlD"}

$ export SIGNED_URL=`curl -s https://test-dot-yourproject.appspot.com/ | jq -r '.url'`

$ curl -s $SIGNED_URL
bar

from google.appengine.ext import webapp
import json 
from datetime import datetime
import time
from datetime import timedelta
import urllib
import base64

from google.appengine.api import app_identity



class MainPage(webapp.RequestHandler):
  def get(self):

    BUCKET_NAME="mineral-minutia-820"
    object_name="foo.txt"
    expiration = int(time.mktime((datetime.now() +
                                  timedelta(days=1)).timetuple()))

    signature_string = 'GET\n\n\n{}\n{}'.format(str(expiration),
                                                '/' + BUCKET_NAME + '/' +
                                                urllib.quote(object_name))
    signature_signed = self.sign(signature_string)

    urlt = 'https://storage.googleapis.com/{}/{}?{}'
    service_account = app_identity.get_service_account_name()
    url = urlt.format(urllib.quote(BUCKET_NAME),
                      urllib.quote(object_name),
                      urllib.urlencode({'GoogleAccessId': service_account,
                                        'Expires': str(expiration),
                                        'Signature': signature_signed}))
    self.response.write(json.dumps({'url': url}))

  def sign(self, plaintext):
      signature_bytes = app_identity.sign_blob(plaintext)[1]
      return base64.b64encode(signature_bytes)

class HealthCheck(webapp.RequestHandler):
    def get(self):
        self.response.set_status(200)
        self.response.out.write('ok')

app = webapp.WSGIApplication([('/', MainPage), ('/_ah/health',HealthCheck)], debug=True)

runtime: python27
api_version: 1
threadsafe: true

handlers:
- url: .*
  script: main.app
  secure: always

libraries:
- name: webapp2
  version: latest

import os
import google
from google.appengine.ext import vendor

lib_directory = os.path.dirname(__file__) + '/lib'


google.__path__ = [os.path.join(lib_directory, 'google')] + google.__path__

vendor.add(lib_directory)