4 files changed, 90 insertions, 4 deletions
diff --git a/services/sync/modules/constants.sys.mjs b/services/sync/modules/constants.sys.mjs
index 958e3345e6..9efe941c0a 100644
--- a/services/sync/modules/constants.sys.mjs
+++ b/services/sync/modules/constants.sys.mjs
@@ -4,7 +4,7 @@
 
 // Don't manually modify this line, as it is automatically replaced on merge day
 // by the gecko_migration.py script.
-export const WEAVE_VERSION = "1.127.0";
+export const WEAVE_VERSION = "1.128.0";
 
 // Sync Server API version that the client supports.
 export const SYNC_API_VERSION = "1.5";
diff --git a/services/sync/tests/unit/test_addons_store.js b/services/sync/tests/unit/test_addons_store.js
index a0a3ac6c69..e3c17e3392 100644
--- a/services/sync/tests/unit/test_addons_store.js
+++ b/services/sync/tests/unit/test_addons_store.js
@@ -43,7 +43,7 @@ AddonTestUtils.overrideCertDB();
 Services.prefs.setBoolPref("extensions.experiments.enabled", true);
 
 const SYSTEM_ADDON_ID = "system1@tests.mozilla.org";
-add_task(async function setupSystemAddon() {
+add_setup(async function setupSystemAddon() {
   const distroDir = FileUtils.getDir("ProfD", ["sysfeatures", "app0"]);
   distroDir.create(Ci.nsIFile.DIRECTORY_TYPE, FileUtils.PERMS_DIRECTORY);
   AddonTestUtils.registerDirectory("XREAppFeat", distroDir);
@@ -137,6 +137,28 @@ const MISSING_SEARCH_RESULT = {
   ],
 };
 
+const AMOSIGNED_SHA1_SEARCH_RESULT = {
+  next: null,
+  results: [
+    {
+      name: "Test Extension",
+      type: "extension",
+      guid: "amosigned-xpi@tests.mozilla.org",
+      current_version: {
+        version: "2.1",
+        files: [
+          {
+            platform: "all",
+            size: 4287,
+            url: "http://localhost:8888/amosigned-sha1only.xpi",
+          },
+        ],
+      },
+      last_updated: "2024-03-21T16:00:06.640Z",
+    },
+  ],
+};
+
 const XPIS = {};
 for (let [name, files] of Object.entries(ADDONS)) {
   XPIS[name] = AddonTestUtils.createTempWebExtensionFile(files);
@@ -215,6 +237,18 @@ function createAndStartHTTPServer(port) {
     );
     server.registerFile("/addon1.xpi", XPIS.test_addon1);
 
+    server.registerPathHandler(
+      "/search/guid:amosigned-xpi%40tests.mozilla.org",
+      (req, resp) => {
+        resp.setHeader("Content-type", "application/json", true);
+        resp.write(JSON.stringify(AMOSIGNED_SHA1_SEARCH_RESULT));
+      }
+    );
+    server.registerFile(
+      "/amosigned-sha1only.xpi",
+      do_get_file("amosigned-sha1only.xpi")
+    );
+
     server.start(port);
 
     return server;
@@ -237,7 +271,7 @@ async function checkReconcilerUpToDate(addon) {
   deepEqual(stateBefore, stateAfter);
 }
 
-add_task(async function setup() {
+add_setup(async function setup() {
   await Service.engineManager.register(AddonsEngine);
   engine = Service.engineManager.get("addons");
   store = engine._store;
@@ -562,6 +596,57 @@ add_task(async function test_create() {
   await promiseStopServer(server);
 });
 
+add_task(async function test_weak_signature_restrictions() {
+  _("Ensure installing add-ons with a weak signature fails when restricted.");
+
+  // Ensure restrictions on weak signatures are enabled (this should be removed when
+  // the new behavior is riding the train).
+  const resetWeakSignaturePref =
+    AddonTestUtils.setWeakSignatureInstallAllowed(false);
+  const server = createAndStartHTTPServer(HTTP_PORT);
+  const ID_TEST_SHA1 = "amosigned-xpi@tests.mozilla.org";
+
+  const guidKO = Utils.makeGUID();
+  const guidOK = Utils.makeGUID();
+  const recordKO = createRecordForThisApp(guidKO, ID_TEST_SHA1, true, false);
+  const recordOK = createRecordForThisApp(guidOK, ID1, true, false);
+  const countTelemetry = new SyncedRecordsTelemetry();
+
+  let failed;
+
+  const { messages } = await AddonTestUtils.promiseConsoleOutput(async () => {
+    failed = await store.applyIncomingBatch(
+      [recordKO, recordOK],
+      countTelemetry
+    );
+  });
+
+  Assert.equal(
+    1,
+    failed.length,
+    "Expect only 1 on the two synced add-ons to fail"
+  );
+
+  resetWeakSignaturePref();
+
+  let addonKO = await AddonManager.getAddonByID(ID_TEST_SHA1);
+  Assert.equal(null, addonKO, `Expect ${ID_TEST_SHA1} to NOT be installed`);
+  let addonOK = await AddonManager.getAddonByID(ID1);
+  Assert.notEqual(null, addonOK, `Expect ${ID1} to be installed`);
+
+  await uninstallAddon(addonOK, reconciler);
+  await promiseStopServer(server);
+
+  AddonTestUtils.checkMessages(messages, {
+    expected: [
+      {
+        message:
+          /Download of .*\/amosigned-sha1only.xpi failed: install rejected due to the package not including a strong cryptographic signature/,
+      },
+    ],
+  });
+});
+
 add_task(async function test_create_missing_search() {
   _("Ensures that failed add-on searches are handled gracefully.");
 
diff --git a/services/sync/tests/unit/test_bookmark_tracker.js b/services/sync/tests/unit/test_bookmark_tracker.js
index 8c26232cd5..6084e48ebd 100644
--- a/services/sync/tests/unit/test_bookmark_tracker.js
+++ b/services/sync/tests/unit/test_bookmark_tracker.js
@@ -534,7 +534,7 @@ add_task(async function test_async_onItemTagged() {
     await startTracking();
 
     // This will change once tags are moved into a separate table (bug 424160).
-    // We specifically test this case because Bookmarks.jsm updates tagged
+    // We specifically test this case because Bookmarks.sys.mjs updates tagged
     // bookmarks and notifies observers.
     _("Insert a tag using the async bookmarks API");
     let tag = await PlacesUtils.bookmarks.insert({
diff --git a/services/sync/tests/unit/xpcshell.toml b/services/sync/tests/unit/xpcshell.toml
index e958c8a738..a7d9130668 100644
--- a/services/sync/tests/unit/xpcshell.toml
+++ b/services/sync/tests/unit/xpcshell.toml
@@ -12,6 +12,7 @@ support-files = [
   "systemaddon-search.json",
   "!/services/common/tests/unit/head_helpers.js",
   "!/toolkit/components/extensions/test/xpcshell/head_sync.js",
+  "../../../../toolkit/mozapps/extensions/test/xpinstall/amosigned-sha1only.xpi",
 ]
 
 # The manifest is roughly ordered from low-level to high-level. When making