there are a couple ways:
1 - when you create the depot software, instead of uploading the msi, upload a directory w/ both the msi and the xml. ??SOURCE?? will be the dir, so your install command would be like:
cd ??SOURCE?? & msiexec foo.msi
2 - add the xml as a 'response file' - create a variable in the install command like:
msiexec /i ??SOURCE?? ??_RESPONSE_FILE??
and you'll be able to upload a file, but i think that will only help if you can reference the path of the install file as an argument to the msi.