A package MUST contain only regular files and directories and there must not be two files or directories in the same directory which names differ only in case (to make sure the package would work equally on case-sensitive and case-insensitive file systems).
Names of the files and directories included in a package SHOULD contain only the following characters:
Numbers (0-9)
Lower-case letters (a-z)
Upper-case letters (A-Z)
Underscore (_)
Minus (-)
Dot (.), except for the end of the name
Space ( ), except for the end of the name
Comma (,)
The following characters are NOT allowed:
Less than sign (<)
Greater than sign (>)
Colon (:)
SemiColon (;)
Double quotes (“)
Backslash (\)
Forwardslash (/)
Vertical bar (|)
Asterisk (*)
Question mark (?)
Any other non-ASCII symbol (including symbols in non-English locales)
The names cannot be directory traversal. For example, it is prohibited to use ‘../’ and absolute paths.
For Windows, the following limitations are set:
The special Windows device names (CLOCK$, CON, PRN, AUX, NUL, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, CONIN$, CONOUT$, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, LPT9, PRN) are NOT allowed to be used in packages, including cases when those names are used with extensions, that is “NUL.txt” is not allowed as well.
All case variants of the above names are NOT allowed.
Space before name extension is NOT allowed.
The total path length to any file or folder within a package MUST NOT exceed 128 characters (this is to address 260-characters limitation of the Windows API - the reserved 128 symbols are used by an APS Controller for the container folder).