The Perfect Fedora Silverblue Setup For The XPS 13

After receiving my new laptop, admiring its fantastical and recyclable packaging, and taking tons of pictures, I decided to do what I always dreamed I could do… I booted directly into the UEFI menu, deleted Windows, and installed Fedora Silverblue. I completely skipped what has been standard practice for me for seven years now, which was to boot into Windows, fully update the system, then check for device firmware updates. I’d then use it with Windows for a while, to see how the device performed, before installing my preferred Linux OS.

I must say, I was very pleased to find that not only were there Firmware Updates available for my device that I could apply directly within Silverblue, but they worked perfectly! And I’ve done this twice now, after new updates for my machine came out, and again, success!

But there’s a catch… Not everything was buttery smooth the way I had expected. 12th gen Intel comes with some quirks, and I spent nearly a week trying to get them ‘unquirked’. This, along with my standard set of tweaks, is what this article intends to address for the benefit of anyone who finds themself needing it!

Installation & Boot Security

First and foremost, Fedora supports Secure Boot. While there are definitely instances in which Secure Boot is a hassle, say for dualbooting or using systems without Secure Boot keys, Silverblue handles it wonderfully and there’s no strapped-on drivers for Nvidia needed, so no issues with that! Turn that Secure Boot on! It’s enabled by default, but if you’ve already configured your system otherwise, you can enable this in your UEFI menu, likely under the “Security” or “Booting” category.

Next up, get that installer loaded. Make sure you’re using EFI boot and not legacy boot, of course! Proceed with the settings that make sense for your time zone and language, and then make sure to enable disk encryption! You can find this in the “Installation Destination” section of the installer, and it’s a checkbox underneath the disk selection options marked “Encrypt my data”. Set your encryption password and proceed!

If you’d like to increase space savings on your system, the next section covers how to do that, so don’t reboot quite yet!

BTRFS Data Compression

By default, Fedora (and Silverblue) ship with BTRFS as the primary filesystem. An inherent benefit of BTRFS is advanced data management features such as compression. Fedora enables ZSTD encryption, at its lowest level, 1. If you’d like, you can increase the compression level of the system a few notches with no noticeable impact on performance.

To do this, you’ll enter a TTY by pressing Ctrl+Alt+F3. (If F3 is taken, try F4 or another.) Then, you’ll want to edit the appropriate fstab file of the newly installed system. With your editor of choice, open /mnt/sysroot/etc/fstab (A sane choice would be nano :P)

nano /mnt/sysroot/etc/fstab

Find the three lines which contain compress=zstd:1 and change the 1 to a number of your choosing. I recommend 6 at the most usually, and this is what I personally use. Save the file with Ctrl+X once you’re done, and then reboot the system. (You can return to the installer with Ctrl+Alt+F6 and press the reboot button, or simply use the reboot command.)

Updates!

Once you’ve booted into your system (you’ll have been prompted to set up your user and cool jazz like that), then make sure to update! The first thing you should do with almost any new system is make sure you’re running the appropriate version of the OS and its software for improved stability, security, and performance. This also helps make sure that you don’t encounter any bugs that have already been fixed. Open Software and proceed to the Updates section. The first update will take some time. Please be patient. If it appears nothing is happening after 5–10 minutes, run killall gnome-software in the Terminal, and then re-open Software and continue. Ensure that you trigger the restart & update button in the “Updates” section of the app. The system will not update its packages on the running system. You need to boot into the updated image.

Flathub Flatpaks!

Once you’ve got all your updates done… Make sure you have access to all kinds of software goodies! By default, there’s a filtered repository for Flathub Flatpaks available, which can be turned on in Software. This lacks many apps you may want. If you’d like the full repository, proceed with the following command in Terminal:

flatpak remote-delete flathub && flatpak remote-add flathub https://flathub.org/repo/flathub.flatpakrepo

The first part of the command removes the existing (and improperly named) filtered Flathub repository. The second part adds it back in its full capacity.

Poweroff On Lid Close

Now this is totally a matter of preference, but I do like that with an encrypted installation, shutting down my machine makes the contents of my system useless without the password. I have Silverblue configured to shut down when I close the lid, rather than suspending. Suspend leaves your system unencrypted, so if you were to lose the laptop or have it taken from you, everything on-disk can still be accessed as the key is in memory.

To set this up, you’ll need to edit a file called logind.conf, which can be found in /etc/systemd/.

sudo nano /etc/systemd/logind.conf

Find the lines that start with “HandleLidSwitch”, and adjust them to your liking. Make sure to remove the “#” at the beginning of the line as well. Save with Ctrl+X and you’re golden! The next time you boot into your system, closing the lid should trigger a system shutdown.

If you ever want to undo this, just edit the same file again, and add # back to the beginning of the lines you’ve changed.

Addressing 12th Gen Intel Issues

For anyone reading this with a 12th gen Intel configuration, or planning to get one, it’s worth noting that at the current moment, there are some driver and feature bugs that cause graphical glitches, such as artifacting bands across the screen. I was able to successfully address this by disabling something called Intel PSR. This is a feature intended to improve battery life by allowing the display to refresh itself without input from the GPU, allowing the GPU to save power by not processing idle frames. (Despite disabling this, I still see exceptional battery life.)

To do this, I added i915.enable_psr=0 to my boot arguments. The command for this is as follows:

rpm-ostree kargs --append=i915.enable_psr=0

Once you reboot, this will apply. If in the future you decide to re-enable this, or want to test if it’s been fixed, you can undo this with the following:

rpm-ostree kargs --delete=i915.enable_psr=0

Next up, freezes and hangs, usually when using the Settings app. While this may not be necessary in all configurations, removing the xorg-x11-drv-intel package has removed any instabilities I experienced which would cause my system to lock up and require shutting down via the power button.

To do this, I ran the following:

rpm-ostree override remove xorg-x11-drv-intel

After a reboot, this should apply. You may undo this at any time with the following command:

rpm-ostree override reset xorg-x11-drv-intel

Fingerprint Login

Fantastic to see, the fingerprint sensor on my XPS — and even my Inspiron prior — works within Linux! To configure fingerprints, open Settings and navigate to the Users menu. From there, you’ll find the “Fingerprint Login” option. Click on this, enter your password, and then add a fingerprint. You’ll be given a list of options of fingers to choose from, and you’ll be asked to place your finger on the sensor multiple times.

While relatively new to me as a user, fingerprint recognition in GNOME has come a long way, and seems to work for authenticating actions in the majority of the desktop. In fact, it seems to even work in a TTY! I believe this is likely thanks to something called PAM. Once you’ve enrolled your fingerprint, you’ll be able to use it to unlock your device, authenticate the addition or removal of software sources, and even run sudo operations in the Terminal!

The only quirk is that logging in requires that you enter your password to unlock the keyring. So, while you can log in with the fingerprint, you’ll need a password anyway, as GDM does not unlock the keyring with anything else. This is already something the developers are aware of, and a fix has not yet been reached. However, you can fix this on your system.

I do not recommend doing this if you’ve not encrypted your installation, though you really should do that regardless. The workaround for this would be to set your keyring password to nothing. Note, this is not the same as changing your user account password, though that is what it’s set to by default. There’s an application called “Passwords and Keys”, AKA “Seahorse”. This can be installed as a Flatpak from Software if you’ve enabled Flathub.

You’ll need to select the “Login” option on the left, and Change Password. Enter your existing password for your user, then set the new password to be empty/nothing and approve when prompted for the change/confirmation.

Once you’ve done this, logging in with your fingerprint will automatically unlock the keyring, preventing you from needing any other password to log in beyond the decryption password when you first boot up your system.

Removing Firefox From The OS

If you’re like me, you’ll likely want to have as many of your apps as possible to be installed via Flatpak, rather than being strapped to your base OS. Currently, Silverblue ships with Firefox installed via rpm-ostree. You can remove it with the following:

rpm-ostree override remove firefox

After a reboot, Firefox will be gone! You can install Firefox as a Flatpak from Software, or another browser of your choosing. There are a decent number of them on Flatpak.

That’s All, Folks!

There’s a lot to do when setting up a new OS, but this covers some of the most major components that matter to me! Plenty of other things I do are even more subjective/preferential, like replacing all of the Flatpaks supplied by Fedora with Flatpaks supplied by Flathub. All of it is in your hands!

Thanks for reading and have fun!