i apologize up front: this is not going to directly answer the OP's question, but when i searched around for "a setup package is either missing or damaged" while trying to offline-install (from unpacked ISO) VS2105 on my (corporate, internet-starved) build server, there were lots of others with same problem with very little help, and this was the top 1 google hit for that dreaded error message...
here's the deal: i was setting up TFS build agent on corporate server with all kinds of security lock down (including access to internet) from an MSDN subsription VS2015w/U3 ISO (unpacked). ran installer - got the error. after rifling through not-so-helpful SO/MS Connect/etc postings, i was able to glean that the digital signatures on some of the sub-packages were failing validation.
if you know anything about PKIs, read this paragraph if you want, if not skip. there was mention that certain CRLs and CA chains were pushed out via Windows updates/patches. who knows if this server has been patched... it certainly could not do it through automatic win updates. in a nut shell, i needed some way to get those missing items so that the digital signature verification would pass. i thought to myself "why would it work on my local machine, because it is on the same patching schedule as the server (presumably, i don't know for sure)". then it occurred to me that one reason MS offers web installers is just this problem... it then occurred to me that they might have a "best effort" kind of strategy for resolving this kind of thing in their offline installer.
(preface: bear in mind that while this worked in a fairly common corporate set up, they're all different and this might not work for everyone)
what i needed was the ability to run the installer on the server, but somehow get it internet access. so i opened Fiddler, allowed other machines to connect to it, configured the server's internet connection settings >> LAN settings to use my machine as a proxy. first make sure that HTTPS is enabled in Fiddler, then open it up, turn in on, go back to your server (that you configured to proxy via your machines IP address and the port that Fiddler uses; default is 8888) and run the installer. you can actually watch the PKI activity in the request captured by Fiddler, among other http-based traffic). the key of this proxy approach is that the server can get what it need from the web, while all that traffic appears to be coming from your machine, from the network firewall's point of view.
anyhow, i hope this saves someone else the 2 days of pain it caused me.