How To Install Composer programatically

If you want to automate the download and installation of Composer, chances are you are trying to figure out how to install Composer programatically. For example, I have a setup at work where I have an install script to create local developer environments in vagrant, which includes Composer. The fatal mistake is copying the Composer download script directly from the website. The reason for this is that the signature regularly changes as the software updates, and Composer downloads with a hard coded signature will fail. Fortunately, Composer offers a very easy way to verify signatures programatically.

To use it in Linux, you can substitute the signature string with:

$(curl -Ss

The full syntax:

php -r "copy('', 'composer-setup.php');"
php -r "if (hash_file('SHA384', 'composer-setup.php') === '$(curl -Ss') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php
php -r "unlink('composer-setup.php');"

The end result of this is that you can install composer on a new machine without having to constantly check the signature on the web.

This is useful if you need a script, or just want a simple executable that downloads and installs Composer without having to visit the web page every time.

Leave a Reply