The reference is just done by having the URL as part of the software/firmware ManagedObject.
Essentially they these objects contain 3 string properties: name, version and url
What you put into the “url” is completely up to you. The Cumulocity UI or backend does not care. It is just important that your device agent understands how it needs to read this string and what it needs to do with it. So if you device agent expects a valid URL simply put the full URL to your file into this string. It also doesn’t matter if this is a URL on Cumulocity.
With 10.7 both repositories got extended with more functionality and therefore also the data model got some changes. The old/current format however will still be recognised by the UI.
The data structures which are just used between Cumulocity UI and backend are in general not documented. Simply because these data structures can change between releases (we however of course try to do that only if needed and ideally with the UI still being able to understand the old structures).
Only the data structures that are relevant for the devices (e.g. the operations for software and firmware) are documented.