A source-code-free verification exchange can give a recipient a reviewable contract of claimed properties and mathematical obligations they can replay themselves. It cannot, by itself, prove that those obligations were generated from the exact private implementation the supplier names. The useful discipline is to keep four things apart: the contract, the mathematical result, the signature, and the provenance of the proof.
The problem SJV and SJP address
The motivating question, as Jupiter Soft frames it in its article “Proof Without Sharing Source Code: SJV, SJP, and the Trust Boundary,” is simple: what if you need to demonstrate properties of a software module without giving the other party its source code? The article describes three distinct objects:
As an Amazon Associate I earn from qualifying purchases.
- Private source code, which stays with the developer.
- An SJV, which states the properties to be proved. Think of it as the contract.
- An SJP, which carries the verification evidence for that contract.
The recipient can review the stated contract and replay the mathematical obligations in the package without ever seeing the source. That is the useful part. The rest of this article is about what that does and does not establish.
What an SJP contains
According to the first-party article, an SJP may contain a verification manifest, input and configuration information, results, SMT obligations, integrity data, and a manifest signature. Replay uses Z3, and CVC5 is described as an optional cross-check. These are the article’s own descriptions of the project. They have not been independently verified against every current implementation detail, so treat the toolchain as what the publisher says it is.
#1 Best Overall
What you can check when you receive an SJP
An SJP supports four separate questions. Each one needs its own answer, and a yes on one does not imply a yes on the others.
1. Contract: are these the properties that matter?
Before any solver output means anything, decide whether the SJV expresses the properties you actually care about. A perfectly replayable proof of the wrong property is still the wrong proof. This is a review task for your own engineers or a domain expert, and it does not require the source.
2. Mathematical evidence: do the obligations reproduce the reported result?
Replaying the stored SMT obligations checks whether they produce the solver result the package reports. This is the one step that is genuinely independent of trusting the supplier. The result holds only within the stated model and assumptions, and only for the properties in the contract.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches3. Signature and identity: whose key signed the manifest?
A valid manifest signature shows that the manifest matches a signature for a particular public key. It does not tell you who controls that key. You need a separate, out-of-band way to confirm the key belongs to the supplier you are dealing with.
4. Provenance: were these obligations generated from the claimed source?
This is the hardest question and the one the first-party article treats most carefully. The obligations must have been produced from the exact source revision and the verification process the supplier describes. Nothing in the replay step checks that link. Stronger assurance requires something outside the package, such as an independent audit, a controlled proof-generation environment, a trusted third-party source review, or an agreed procedure that records the source revision and verification steps.
What replay proves, and what it does not
Replay answers a narrow mathematical question: do the stored obligations support the reported result? The article states the limit directly:
“A verifier can replay the mathematical obligations stored in an SJP without seeing the source code. But that alone does not prove that those obligations were correctly generated from the particular closed-source implementation claimed by the developer.” — Jupiter Soft, “Proof Without Sharing Source Code: SJV, SJP, and the Trust Boundary”
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
A successful replay therefore establishes that the stored obligations are consistent with the reported result. It does not establish that the software is free of bugs outside the contract, nor that the obligations describe the code you are running.
What a signature does and does not prove
A signature binds the manifest to a key. It proves integrity of the manifest relative to that key. It does not prove the key owner’s corporate identity, and it does not prove that the proof was generated correctly. A valid signature on a package whose obligations were produced from a different source revision would still verify. Treat the signature as one link in the chain, not as the chain.
Is SJV/SJP zero-knowledge?
No, not on the evidence available. The first-party article says the exchange should not automatically be called a zero-knowledge proof, because the recipient sees the contract and the proof obligations. Its summary of the approach is:
“We can transfer a formal contract and replayable verification evidence without transferring the source code, while explicitly separating mathematical verification from proof provenance.” — Jupiter Soft, same article
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Source nondisclosure and cryptographic zero knowledge are different claims. Describing the first as the second would overstate what the recipient learns and what they can verify.
Best Value
How this compares with related approaches
Several approaches address neighbouring parts of the problem. They are not interchangeable. The table compares them on the axes that matter for a trust decision.
| Approach | What is bound | What the recipient sees | Who must be trusted | What can be replayed independently | Privacy claim |
|---|---|---|---|---|---|
| SJV/SJP (Jupiter Soft, first-party article) | Contract to SMT obligations; manifest to a signing key | The SJV contract, the SJP evidence, and the manifest | The proof generator and process, and the key owner, for provenance and identity | Stored SMT obligations, replayed with Z3 (CVC5 optional) | Source is not disclosed; the article says this is not zero knowledge |
| Amanat protocol (Chaki, Schallhart, Veith, 2007 arXiv submission) | A verification task run by a dedicated server | Not stated in the source | The dedicated server’s channel controls, as designed by the supplier | Not stated in the source | Supplier controls channels to prevent source leakage |
| Zero-knowledge compilation (arXiv:2602.11887, 2026) | Compiler run in a zkVM, linked to claimed source and compiler inputs | Not stated in the source | Not stated in the source | A compilation proof, as a proposal and proof of concept | Described by its authors as zero-knowledge compilation |
| Source-code verification on Ethereum (ethereum.org) | Source and compilation settings against deployed bytecode | Published source | Not stated in the source | Recompilation against deployed bytecode | Not applicable; source is published |
The Amanat protocol
Sagar Chaki, Christian Schallhart, and Helmut Veith described the supplier and customer problem in “Verification Across Intellectual Property Boundaries,” submitted to arXiv on 29 January 2007. Their description is concise:
“The customer controls the verification task performed by the amanat, while the supplier controls the communication channels of the amanat to ensure that the amanat does not leak information about the source code.”
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
This is a historical comparator for the same intellectual-property boundary. It is not evidence that SJV/SJP uses this protocol.
Zero-knowledge compilation
The 2026 arXiv preprint “Verifiable Provenance of Software Artifacts with Zero-Knowledge Compilation” addresses a different link in the chain. It proposes running a compiler in a zkVM and producing a proof that compilation used the claimed source and compiler inputs. Its authors report evaluation on 252 programs: 200 synthetic C programs, 21 OpenSSL source files, and 31 libsodium source files. Those figures describe the study’s own evaluation. They are not a general performance result or a production-readiness claim. The preprint is a proposal and proof of concept, and it differs from the portable SMT-obligation model in the SJV/SJP article.
Source verification on Ethereum
ethereum.org distinguishes source-code verification, which checks source and compilation settings against deployed bytecode, from formal verification, which checks whether behaviour meets a specification. It is a useful analogy for the difference between provenance and mathematical checks, but it is not a definition of SJV or SJP.
Quick Recap
What to request before you rely on an SJP
- The SJV in full, reviewed against the properties your organisation needs.
- The SJP, including the manifest, the SMT obligations, and the integrity data, so you can replay the obligations yourself.
- The solver versions used for generation and replay, and the result you should expect to reproduce.
- The source revision identifier the proof is said to cover.
- A description of the proof-generation environment and the steps that link it to that revision.
- The public key used for the manifest signature, confirmed through a channel independent of the package.
- Where the stakes justify it, an independent audit or a jointly agreed process that records the revision and verification procedure.
Scope and limits
- SJV and SJP mechanics, toolchain choices, and suggested provenance steps come from the first-party article. It is the developer’s own description, not an independent audit of the product.
- A successful result covers only the contract, the model, the assumptions, and the verification scope. It does not show that the software is universally bug-free.
- The article’s publication date appears on the page as “Sep 26” without a year, so this article does not assign it one.
- No independent performance comparison or adoption figure for SJV or SJP was found. Do not infer industry uptake from the article.
The Bottom Line
“”
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
