# ISO Verification Issues - My first steps are difficult and confusing

**URL:** <https://discuss.kde.org/t/iso-verification-issues-my-first-steps-are-difficult-and-confusing/40255>\
**Category:** Help\
**Tags:** neon, isoimagewriter, downloads\
**Created:** [October 2, 2025, 8:27pm UTC](https://discuss.kde.org/t/iso-verification-issues-my-first-steps-are-difficult-and-confusing/40255 "2025-10-02T20:27:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SebastJava](https://discuss-cdn.kde.org/user_avatar/discuss.kde.org/sebastjava/32/32084_2.png) [@SebastJava](https://discuss.kde.org/u/SebastJava)\
**Post date:** [October 2, 2025, 8:27pm UTC](https://discuss.kde.org/t/iso-verification-issues-my-first-steps-are-difficult-and-confusing/40255/1 "2025-10-02T20:27:03Z")

</div>

I’m currently using Fedora KDE 42 and want to test KDE Neon.

I downloaded these two files:

- neon-user-20251002-0758.iso
- neon-user-20251002-0758.iso.sig

**KDE ISO Image Writer** checks the ISO and replies: “Uses wrong signature”.

 ![Screenshot_20251002_154225](https://discuss-cdn.kde.org/uploads/default/original/3X/a/4/a4d19f5d88db17e6219e9a243c4027e14af0c3de.png)

So I turned to **ChatGPT** for help:

1. Download the ISO + the ‘.sig’
2. Import the official key:  
`gpg --keyserver keyserver.ubuntu.com --recv-keys 45F4C354638D1F29`
3. Check the ISO:  
`gpg --verify neon-user-20251002-0758.iso.sig neon-user-20251002-0758.iso`

RESULTS:

```auto
gpg: Signature made Thu 02 Oct 2025 04:21:18 AM EDT
gpg: using RSA key B74EA2162376765BEAC3AE4345F4C354638D1F29
gpg: Good signature from “KDE neon ISO Signing Key <neon@kde.org>” [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: B74E A216 2376 765B EAC3 AE43 45F4 C354 638D 1F29

```

Well, it says “ **good signature** ” and ChatGPT tells me not to worry about the warning.

DOUBLE-CHECK

I found a sha256sum and that result is also OK:

```auto
sha256sum -c neon-user-20251002-0758.sha256sum
neon-user-20251002-0758.iso: OK

```

THOUGHTS

Did I miss something? Is there any good tutorial for KDE Neon ISO verification?

Let’s forget the failure of KDE ISO Image Writer, I’ll use balenaEtcher instead.

---

<div class="post-metadata">

**Author:** ![Sadi](https://discuss-cdn.kde.org/user_avatar/discuss.kde.org/sadi/32/8883_2.png) [@Sadi](https://discuss.kde.org/u/Sadi)\
**Post date:** [November 8, 2025, 9:01am UTC](https://discuss.kde.org/t/iso-verification-issues-my-first-steps-are-difficult-and-confusing/40255/2 "2025-11-08T09:01:12Z")

</div>

It seems the underliying problem here is that one should better enter the command `echo “B74EA2162376765BEAC3AE4345F4C354638D1F29:6:” | gpg --import-ownertrust`  
after importing the key to mark the signature owner as a trusted source.  
The `gpg --verify` command works more or less without this, but apparently **KDE ISO Image Writer** takes that warning too seriously, and even misinterprets it, which can be regarded as a **bug**.

---

<div class="post-metadata">

**Author:** ![SebastJava](https://discuss-cdn.kde.org/user_avatar/discuss.kde.org/sebastjava/32/32084_2.png) [@SebastJava](https://discuss.kde.org/u/SebastJava)\
**Post date:** [November 8, 2025, 4:17pm UTC](https://discuss.kde.org/t/iso-verification-issues-my-first-steps-are-difficult-and-confusing/40255/3 "2025-11-08T16:17:57Z")

</div>

> [@Sadi](#):
>
> It seems the underlying problem here is that one should better enter the command `echo`…

Yes ! That solves this issue. There was just a tiny little mistake in your command line.

The quotation marks should be: `" "`, not `“ ”`

I’ve done digital editing in the past, so my eyes can spot a pixel difference immediately. 🙂

Anyway the exact command is:

```auto
echo "B74EA2162376765BEAC3AE4345F4C354638D1F29:6:" | gpg --import-ownertrust

```

I will copy your edited post into my [bug report](https://bugs.kde.org/show_bug.cgi?id=511805). Thanks.

---

<div class="post-metadata">

**Author:** ![Sadi](https://discuss-cdn.kde.org/user_avatar/discuss.kde.org/sadi/32/8883_2.png) [@Sadi](https://discuss.kde.org/u/Sadi)\
**Post date:** [November 8, 2025, 4:48pm UTC](https://discuss.kde.org/t/iso-verification-issues-my-first-steps-are-difficult-and-confusing/40255/4 "2025-11-08T16:48:56Z")

</div>

> [@SebastJava](#):
>
> There was just a tiny little mistake in your command line.
> 
> The quotation marks should be: `" "`, not `“ ”`

Haha, I have no idea how and where those double quotes were converted to smart quotes.😀