[GUIDE] Debian unstable (sid) on the Framework Intel Laptop

This thread is to manage the content on Debian unstable (sid) branch. For Debian’s 3 kind of branches: unstable (sid), testing and stable, you can see Debian releases and Debian#Branches - Wikipedia.


As someone who has been daily-driving Debian sid for years at this point, it was only natural that I go with Debian sid on the Framework. Here was the process I followed (everything was pretty simple and straight-forward):

  1. Install Debian using this ISO (it’s the current weekly netinstall ISO build and includes nonfree firmware). Personally, when installing, I select the bare minimum to make the upgrade to sid easier in the next step.
  2. Once booted into the new install, remove everything from /etc/apt/sources.list and put the following in /etc/apt/sources.list.d/debian.sources (you can select a different mirror if you wish, and you can find a list of mirrors here; if you do this, the URIs field will be the hostname + HTTP fields in the table and nothing else should change).
Types: deb deb-src
URIs: https://mirrors.wikimedia.org/debian/
Suites: unstable experimental
Components: main contrib non-free-firmware non-free
  1. Once you’ve edited the sources, do sudo apt update && sudo apt dist-upgrade. If you did the minimal install (like I do), this should be fast and have few/no conflicts.
  2. Now, you can install whatever desktop environments/window managers/etc you want (if you want to replicate the installer experience, you can do e.g. sudo tasksel install <task> and you can get a list of tasks by doing tasksel --list-tasks; for example, if you want to install Gnome the way the installer would, simply run sudo tasksel install gnome-desktop).

Fingerprint authentication

To enable fingerprint authentication system-wide with a fallback to password authentication, you do the following:

  1. Install fprintd and the fprintd PAM module: sudo apt install fprintd libpam-fprintd.
  2. Enroll your fingerprint: sudo fprintd-enroll $USER and keep scanning your finger until it comes back with “Enrollment successful” (I think I had to do it 10 times?).
  3. Enable fingerprint authentication: sudo pam-auth-update and check the “Fingerprint authentication” box (the spacebar will toggle whether something is enabled). Don’t edit any of the other modules — simply enable fingerprint authentication, hit the tab key to switch to the “OK” button, and hit the enter key to save.
  4. You can test this out by doing sudo -k && sudo -i, which clears the sudo authentication cache and then opens a root shell (so it will prompt for authentication).

If you previously registered your fingerprints (either in Windows or another Linux install) and didn’t clear them before installing Debian, use this to clear the fingerprint reader’s internal memory so that you can register your fingerprints again.

Deep sleep

As with other Linux distros, you should add mem_sleep_default=deep to switch to deep sleep (different from hibernate) as the default.

  1. Run sudoedit /etc/default/grub and add mem_sleep_default=deep at the end of the GRUB_CMDLINE_LINUX_DEFAULT parameter (inside the quotes). So for example, mine used to be GRUB_CMDLINE_LINUX_DEFAULT="quiet splash" and I changed it to GRUB_CMDLINE_LINUX_DEFAULT="quiet splash mem_sleep_default=deep".
  2. Run sudo update-grub2 to update the bootloader configuration.
  3. Reboot to use the new default.


Out of the box, Framework enables secure boot. This is fine for booting Debian, but it puts the kernel in a restricted mode where hibernate is disabled. If you want to enable hibernation (highly recommended for battery savings), you’ll want to disable Secure Boot in the UEFI settings. Once you do this, hibernate should just work.


I use Wayland with sway as my compositor. The default scaling is 2, which is a bit too large for my taste, so I set output eDP-1 scale 1.5 in my sway config. As expected, Wayland-native programs are sharp, but Xwayland windows have slight blurring in the fonts. I’ve setup Firefox and Signal-Desktop to be Wayland-native (passing MOZ_ENABLE_WAYLAND=1 as an environment variable when starting Firefox and passing the options --enable-features=UseOzonePlatform --ozone-platform=wayland when starting Signal-Desktop), so the only program I use regularly which is running on Xwayland is emacs, which should hopefully soon be fixed.

UEFI Updates

I recently updated my UEFI from version 3.06 (the version my Batch 5 came with) to 3.07 (mainly for the charging limit feature). Until LVFS is setup, the easiest way to do this is to use the UEFI shell update method.

The releases are put up on here, and I’ve linked to the 3.07 release in this post.

  1. Run sudo grub-install --removable to make sure you’ll be able to boot without needing the ‘Debian’ boot entry (EFI boot variables are apparently cleared on upgrade). This will overwrite the /efi/EFI/BOOT/BOOTX64.EFI file if something else has written to it, so keep that in mind if you e.g. dual-boot. This is only needed once, so if you already have GRUB installed in that location, you can skip this step.
  2. Download the EFI shell updater
  3. Format a flash drive as VFAT (e.g. mkfs.vfat /dev/<whatever>).
  4. Mount the flash drive (e.g. pmount /dev/<whatever> or sudo mount -t auto /dev/<whatever> /mnt/<whatever>).
  5. Copy the zip file to the flash drive.
  6. Unzip the zip file. This should leave you with an efi directory and a few other files at the ‘root’ of the flash drive (H2OFFT-Sx64.efi, hx20_capsule_dvt2_3.07.bin, and startup.nsh).
  7. Plug in the charger.
  8. Reboot and boot from the flash drive (make sure Secure Boot is disabled and press F12 while booting to select the flash drive).
  9. Follow the prompts and just wait for the update to finish.
  10. After booting in Debian, run sudo grub-install to restore the EFI boot entry variables.

Other things

If there are other things you want me to explain about my setup, I can add other posts to this thread (or possibly update this post depending on edit policy?), so just let me know! I’m more than happy to explain my setup and update with anything else I’ve tweaked. As far as I remember, these were the main “general” tweaks I had to do.

See also


Tried and failed. Even with the non-free firmware included on the USB drive, the installer keeps requesting that I plug in a USB drive with the non-free firmware on it.

It cannot even figure out its own stuff.

You just hit enter and it should load the firmware.

Yeah, no, it doesn’t. As I said, it “keeps requesting”. In other words, I hit ENTER, it reads the USB drive, then the same screen pops up. I can hit ENTER all day long and go nowhere.

That’s really odd. How did you burn the image to the USB?

The USB formatting utility is irrelevant, but in the interest of full disclosure, I’m using Rufus v3.17.

This is absolutely not true. Sometimes the formatting utility can mess things up.

I really don’t know, since I usually use dd to format my USB sticks and it’s never failed. Once you boot into the installer and get to the firmware step, can you change to a different TTY (e.g. type Ctrl+Alt+F2), press enter to activate the console, and run dmesg to see if there are any errors. Further, you can try dpkg -i /firmware/firmware-iwlwifi_20210818-1_all.deb to manually load it.

I want to emphasize that something is wrong here, since I absolutely did not have to do any of this and it all worked seamlessly during install. Maybe it’s Rufus. Maybe your ISO download is corrupted (you can finding the sha256 or sha512 checksums and comparing against the ones on the website).

1 Like

I recommend you amend your original post to inform users that they should write the image to the USB drive in “DD Image mode.”

In Rufus, after loading up the ISO image and clicking START, one of the popups that will appear right before it begins to write data to the drive is “ISOHybrid image detected”. It allows the user to select if they want to write the image in “ISO Image (file copy) mode” (which they recommend) or in “DD Image (disk image) mode.” The ISO Image mode allows for full access to the drive after writing to it whereas the DD Image mode does not.

I honestly did not think this choice would make any difference whatsoever until you mentioned that you use something called dd to format your USB drives.

My apologies if I came across as rude. It’s been a long day.


Also, I’m getting the same problem as I did with Ubuntu when attempting to register a fingerprint.

In Gnome: “Failed to claim fingerprint device Goodix MOC Fingerprint Sensor: the device is already claimed by another process.”

In the terminal: “failed to claim device: GDBud.Error:net.reactivated.Fprint.Error.AlreadyInUse: Device was already claimed”

Hmm, the only reference I found to that error is here, but it makes me wonder if you tried setting up fingerprint authentication on Windows before installing Linux?

Nope. My very first attempts with this Framework laptop were with Ubuntu. Regardless, you also own a Framework laptop, so you can verify that there is no “Predesktop Authentication” setting in BIOS.

I know, but people have reported issues with registering fingerprints under Windows and then installing Linux, hence I asked.

Further, this thread mentions that setting up the fingerprint reader in Windows (even just installing the driver) might have locked the device to Windows, and there’s a link to another post on there that explains how to fix it. Specifically, try this appimage.

In the other thread, you mentioned that you were going to setup Windows, so I’m wondering if you actually followed through on that. Regardless, something here has to do with the fact that you’ve reinstalled the OS multiple times (and maybe setup your fingerprints on a previous install).

Does the fingerprint device itself have its own, separate non-volatile memory where it stores the fingerprints that have been scanned? If so, I wonder if the times when I was able to successfully scan fingerprints (way back during my first Ubuntu installation) have taken up those spots in its memory and now I need to run the scripts or whatever in the other thread to erase them from memory and start from a blank slate.

Yes, it does. I believe that you’re on the right track regarding running the python script to clear out any existing prints, then trying again to enroll a new one. Best of luck!

1 Like

By the way, I made this a wiki post so that others can edit with their experience (or clarify things). @Christopher_McGee, feel free to add parts specific to your experience if you wish :slight_smile:

Sounds good. I’ve posted my experiences in the main thread. Feel free to paraphrase it here if you like.

1 Like

I renamed “Setting up Debian sid on the Framework” to “Debian unstable (sid) on the Framework Laptop” aligning other distro threads on “Linux” category. I also wanted to emphasize this thread is for unstable (sid) branch but not for testing branch for now. Though it might be this thread could include testing branch in the future.

As a reference, to know 3 kind of branches: unstable (sid), testing, stable branches, the following documents are useful.


I updated this thread’s wiki adding “See also” section to add links to Debian testing and stable branches, and Debian based Linux threads for convenience.

1 Like

any ideas on how to prevent BIOS updates from screwing with EFI boot? how does ubuntu work around this?

Run sudo grub-install --removable and you should always be able to boot back up even if the EFI boot entries have been removed.

1 Like