How a transaction proves its ownership of the its source, which can be one or multiple unspent output? I read the following from the book &lt;&lt; Mastering Bitcoin >>


  "As you may notice, the transaction contains an empty scriptSig because we haven’t signed it yet. Without a signature, this transaction is meaningless, we haven’t yet proven that we own the address from which the unspent output is sourced."


I am wondering how a signature can prove that this transaction owns the address from which the unspent output is sourced?
Assume you understand how public-key cryptography works. In short, one can verify the ownership of an address by checking the signature. A valid signature can only be generated by the private key owner.

The detail of signature verification in Bitcoin is described here

Without digging into the details, OP_xxx are stack operations. For example, OP_DUP is to duplicate top of the stack. Basically it 


first hashes the public key by operation OP_HASH160 and check if the result is identical to pubKeyHash by operation OP_EQUALVERIFY
then verifies sig and pubKey by operation OP_CHECKSIG


You can read more about OP_CHECKSIG here