This breakdown of the Cloud Native Computing Foundation’s secure software factory guidance focuses on software provenance and build activities.