http://www.voidlinux.eu/usage/xbps/#creating-a-local-repository

Packages must be stored in a repository to check its sha256 hash, or its 
digital signature
(RSA) in remote repositories.