Minimally, there are two ways to define a CheckSpec. To load a check from the project's test output directory, you must specify the impl value as a classPath-relative resource name for script checks, or as a fully-qualified class name for Java ProgressCheck implementations.

For example, if your script check source is located at src/test/resources/OAKPAL-INF/scripts/acme-vault-enforcer.js:

<checks>
  <check>
    <impl>OAKPAL-INF/scripts/acme-vault-enforcer.js</impl>
  </check>
</checks>

If your impl represents a script check or a ProgressCheckFactory, you can also provide a config element that will be translated to a JsonObject by the JsonConverter via the OakpalComponentConfigurator:

<checks>
  <check>
    <impl>OAKPAL-INF/scripts/acme-vault-enforcer.js</impl>
    <config>
      <apples>
        <apple>Granny Smith</apple>
        <apple>Red Delicious</apple>
        <apple>IIe</apple>
      </apples>
      <requirePolicyNode>true</requirePolicyNode>
    </config>
  </check>
</checks>

To reference a check from a specific checklist, available on the plugin or project test-scope classpath, you should not specify the impl property, but instead reference it by name, in one of the following formats, in order of increasing specificity,

1. name
2. checklistName/name
3. module/checklistName/name

For example, the oakpal core library provides some useful checks in the basic checklist, like echo, which prints progress events to System.out:

<checks>
  <check>
    <name>net.adamcin.oakpal.core/basic/echo</name>
  </check>
</checks>

It can also be referenced by shorter forms:

<checks>
  <check>
    <name>basic/echo</name>
  </check>
</checks>

<checks>
  <check>
    <name>echo</name>
  </check>
</checks>

You can also override the configs defined by a checklist for a given check:

<checks>
  <check>
    <name>basic/paths</name>
    <config>
      <rules>
        <rule>
          <pattern>/etc/tags(/.*)?</pattern>
          <type>deny</type>
        </rule>
        <rule>
          <pattern>/etc/tags/acme(/.*)?</pattern>
          <type>allow</type>
        </rule>
      </rules>
      <denyAllDeletes>true</denyAllDeletes>
    </config>
  </check>
</checks>

If this is set to true, be sure the verify goal has been activated for the build, otherwise violations will not be printed and failure-level violations will be implicitly ignored.

FYI: FileVault Importer errors are reported as MAJOR by default.

For example, to ensure that /home/users/system is created as a rep:AuthorizableFolder, you would add a forcedRoot element with a path of "/home/users/system" and a primaryType of "rep:AuthorizableFolder".

<forcedRoots>
  <forcedRoot>
    <path>/home/users/system</path>
    <primaryType>rep:AuthorizableFolder</primaryType>
    <mixinTypes>
      <mixinType>rep:AccessControllable</mixinType>
    </mixinTypes>
  </forcedRoot>
</forcedRoots>

PROHIBIT

Report a violation if any hook is registered successfully. Implies REPORT, and SKIP, insofar as the hook will not be executed after registration. Use this level if your policy is to disallow install hooks in your content packages.

REPORT

Report a violation if any hook fails to register. This is likely a class loading issue, or an issue with Jar or Vault packaging. Similar to ABORT, except scan will proceed.

ABORT

Abort the scan if any hook fails to register. This is likely a class loading issue, or an issue with Jar or Vault packaging.

SKIP

Disable install hook processing for scanned packages.

DEFAULT (= REPORT)

Explicitly request the default policy be used.

For example:

<jcrNamespaces>
  <jcrNamespace>
    <prefix>crx</prefix>
    <uri>http://www.day.com/crx/1.0</uri>
  </jcrNamespace>
</jcrNamespaces>

For example:

<jcrPrivileges>
  <jcrPrivilege>crx:replicate</jcrPrivilege>
</jcrPrivileges>

For example:

<preInstallArtifacts>
  <preInstallArtifact>
    <groupId>com.adobe.acs</groupId>
    <artifactId>acs-aem-commons-content</artifactId>
    <version>3.9.0</version>
    <type>zip</type>
  </preInstallArtifact>
</preInstallArtifacts>

Examples:

<repoInit>
  create path /apps
  create path (sling:Folder) /content/dam
</repoInit>

<repoInit>
  <![CDATA[
    register nodetypes
    <<===
    <'sling'='http://sling.apache.org/jcr/sling/1.0'>
    [sling:Folder] > nt:folder, nt:unstructured
    ===>>
  ]]>
</repoInit>