Creating a provenance hash for NFTs

I'm not sure how to create a provenance hash for a collection of NFTs that is generated from an array of objects.

From what I read so far, the provenance hash is created to show that images and metadata is not changed after deployment or during mint.

This is how I understand it and what I have so far.

  1. In my case, while looping through the array of data, drawNft is called where a temporary metadata and image are created.
const drawNft = (data, index) => {
    //... more stuff here

    createTempMetadata(data, index, background.name)

    loadImage(`./test/${color}.png`).then(image => {
        context.drawImage(image, 0, 350, 1035, 250)
        const buffer = canvas.toBuffer("image/png")
        fs.writeFileSync(`./server/nfts/${index}.png`, buffer)
    })
}
  1. After the images are created and uploaded to an ipfs storage(I found https://nft.storage/. Are there any better alternatives?)
  2. After getting the CID (something like this bafybeihslhol5draa26unhhe7j2crwedr4tyfrvmba5qt3kyxbvb5olk4i ) the temp metadata is looped through once again creating the image url and creating the final metadata.
    Would it be here that the provenance hash is created for each one of these metadata files? It seems appropriate since the url of the image is set and theoretically unchangeable.

This is where it gets confusing for me. The NFTs won't be revealed until the collection is minted, or after some time, so the hash can only be set then. But it has been created prior to that so what's keeping me from changing it?

    function setProvenanceHash(string memory provenanceHash) public onlyOwner {
        _provenanceHash = provenanceHash;
    }