For SLSA compliance we need to separate builds into different stages: fetch, compile, upload. This requires the packaging script to generate the artifact/metadata and upload the generated files separately.

This will be implemented in two different places:

• The packaging script will need to download the metadata file and updated it locally even when the deploy option is not used.
• The packaging recipe to upload the metadata file when running from a stable/beta branch.