Separating fetching from building for better security

That breaks for git and path dependencies as well as any custom registries in use.