diff --git a/playbooks/roles/package/files/build.sh b/playbooks/roles/package/files/build.sh
index c28264d..fa801b8 100755
--- a/playbooks/roles/package/files/build.sh
+++ b/playbooks/roles/package/files/build.sh
@@ -48,7 +48,13 @@
 cat /tmp/decompress.sh "$OFFLINE_PKG_FILE" > "$OFFLINE_INSTALLER_FILE"
 chmod +x "$OFFLINE_INSTALLER_FILE"
 
-# remove intermediate offline pkg file
-rm -rf "$OFFLINE_PKG_FILE"
+# NOTE (fdegir): if the packaging is run by release job, that job stored release
+# metadata in release.properties file. If this file exists, we need to keep tarball
+# as that must be uploaded for further delivery. The reason for this is that the
+# installer can not be scanned by XRAY
+if [[ ! -f "/tmp/release.properties" ]]; then
+  # remove intermediate offline pkg file
+  rm -rf "$OFFLINE_PKG_FILE"
+fi
 
 # vim: set ts=2 sw=2 expandtab:
diff --git a/playbooks/roles/package/tasks/main.yaml b/playbooks/roles/package/tasks/main.yaml
index d47f08d..6634c2a 100644
--- a/playbooks/roles/package/tasks/main.yaml
+++ b/playbooks/roles/package/tasks/main.yaml
@@ -67,6 +67,18 @@
     - {src: "install.sh", dest: "{{ offline_pkg_folder }}/install.sh"}
     - {src: "decompress.sh", dest: "/tmp/decompress.sh"}
 
+# check if the packaging is run by release job by looking at /tmp/release.properties
+- name: Check if /tmp/release.properties file exists
+  stat:
+    path: /tmp/release.properties
+  register: release_properties
+
+# record repo shas in release.properties file if it exists and
+# copy release.properties to tarball
+- name: Record engine repo SHAs in release.properties
+  include_tasks: record-shas.yaml
+  when: release_properties.stat.exists
+
 # create tarball
 - name: Create engine installer file
   script: build.sh
diff --git a/playbooks/roles/package/tasks/record-shas.yaml b/playbooks/roles/package/tasks/record-shas.yaml
new file mode 100644
index 0000000..4b09a59
--- /dev/null
+++ b/playbooks/roles/package/tasks/record-shas.yaml
@@ -0,0 +1,53 @@
+---
+# ============LICENSE_START=======================================================
+#  Copyright (C) 2019 The Nordix Foundation. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+# NOTE (fdegir): ansible-lint complains due to using command module for
+# getting git sha and it is suppressed since it is not possible to get
+# sha using ansible git module
+- name: Fetch commit shas of repos
+  command: git rev-parse HEAD  # noqa 303
+  register: commit_shas
+  with_items:
+    - engine-ironic
+    - engine-bifrost
+    - engine
+  args:
+    chdir: "{{ git_folder }}/{{ item }}"
+  changed_when: false
+
+- name: Populate dictionary to map repos to shas
+  set_fact:
+    repos_shas: "{{ repos_shas|default({}) | combine( {item.item | upper | replace('-', '_') + '_SHA': item.stdout} ) }}"
+  with_items: "{{ commit_shas.results }}"
+
+- name: Record git SHAs to /tmp/release.properties file
+  lineinfile:
+    path: /tmp/release.properties
+    state: present
+    create: true
+    line: "{{ item.key }}={{ item.value }}"
+  with_dict: "{{ repos_shas }}"
+
+- name: Copy /tmp/release.properties into offline package
+  copy:
+    src: /tmp/release.properties
+    dest: "{{ offline_pkg_folder }}/release.properties"
+    force: true
+
+# vim: set ts=2 sw=2 expandtab: