Signature with appendix I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the form $(M,s)$

The appendix is referred to the message or the signature ?

Thank you.
In a signature scheme with appendix (such as RSASSA-PSS), the signature $s=\operatorname{Sign}(M,\text{PrivateKey})$ of the message $M$ is usually appended to the unmodified message $M$, forming $(M,s)$ or $M\mathbin\|s$. This is effectively sent, and verified; the signature is an appendix to the message.

Signature scheme with appendix opposes to signature scheme with message recovery (such as ISO/IEC&nbsp;9796-2). In the later kind, all or some of the message is embedded in the signature. When all of the message is embedded, the verification procedure requires only $s=\operatorname{Sign}(M,\text{PrivateKey})$ as input, and recovers $M$ as a by-product (that's known as total message recovery). Only the signature is sent; it embeds the message.

In the case of RSA, signature schemes with message recovery provide significant bandwidth or space saving for signed messages about the size of the public key used, including public key certificates; that's why they are common in the field of Smart Cards.