SLSA3 Missing pieces

This issue is meant to track the remaining work needed to push towards SLSA3 in our release process. This initial dump is meant to dump the remaining tasks before we prioritize them. Please note that pushing towards SLSA level 3 means effectively complying with level 2, thus all L2 tasks are folded into this list.

These remaining items are based on our [SLSA Compliance Assessment tracking sheet](https://docs.google.com/spreadsheets/d/1fNdJJZZdEJAJU0ZaCnYcIlZA3L-bwT7vY7ZesqW3WEs/edit#gid=0).

## Remaining SLSA Level 3 Compliance Tasks:

### Provenance - Service Generated

- [ ] https://github.com/kubernetes/release/issues/2611
- [ ] Builder: Support for writing initial, partial attestation and "sleeping" (persisting it to disk)
- [ ] Builder: Complete persisted attestations: Read build-generated subjects and assemble pending statement
- [ ] GCB: Attach a volume to write and retrieve provenance metadata
- [ ] GCB: Add step to write initial attestation before staging
- [ ] GCB: Add step to complete provenance attestation after staging
- [ ] GCB: Add step to write initial attestation before release
- [ ] GCB: Add step to complete provenance attestation after release

### Build as Code

- [x] Builder: Run from a configuration file. (It was tasked in our initial assessment, ticked as we are running already from GCB configuration files)

### Provenance - Non-falsifiable

- [ ] Builder: Implement attestation signing to sign in post-stage and post-release steps
- [x] https://github.com/kubernetes/release/issues/2617

### Identify Entry Point

- [ ] Write entry point (k/release commit) is recorded in attestations

## Related Efforts:

### Ensure Integrity of Our Builder!

- [ ] Sign `k8s-cloud-builder` image
- [ ] GCB: Verify `k8s-cloud-builder` image before stage
- [ ] GCB: Verify `k8s-cloud-builder` image before release
- [ ] https://github.com/kubernetes-sigs/release-sdk/issues/94

### File Signing

- [x] https://github.com/kubernetes/release/issues/2618

### Sign & Promote SBOMs

- [x] https://github.com/kubernetes-sigs/promo-tools/issues/600
- [x] https://github.com/kubernetes-sigs/promo-tools/issues/601

***Note:** tasks prefixed with _Builder:_ are part of an upcoming provenance builder proposal (not ready yet)

Start with the SLSA Compliance Assessment tracking sheet and the unchecked tasks in this issue, then read the linked release issues 2611, 2617, and 2618 plus release-sdk issue 94. The work is not yet a single implementation task: completion requires splitting and prioritizing the remaining builder, GCB, signing, and entry-point items into separately scoped issues.

Written by the indexing model from the issue text.