Each package MUST contain a well-formed XML file named APP-LIST.xml in the package root directory. This file contains a list of all files in the package, except APP-LIST.xml itself. The file may be digitally signed by one or more signers.
The APP-LIST.xml file MUST be valid according to the following
schema and be in the UTF-8 encoding.
The XML namespace of the package listing will be changed when incompatible changes are introduced.
Signature(s) of a package listing file should match the specification (if present). Enveloped Signature Transform should be used as the transform algorithm.
Usually a packager should sign an APS package with a package certificate. An APS certification authority SHOULD also sign the package on successful certification.