CINXE.COM
How do I install Composer programmatically? - Composer
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>How do I install Composer programmatically? - Composer</title> <meta name="description" content="A Dependency Manager for PHP"> <meta name="viewport" content="width=device-width,initial-scale=1"> <link rel="stylesheet" href="/build/app.css?v=1"> </head> <body> <div id="container"> <header> <a href="/" title="Go back to the homepage" aria-label="Go back to the homepage">馃彔 Home</a><a class="" href="/doc/00-intro.md" title="Getting started with Composer" aria-label="Getting started with Composer">Getting Started</a><a class="" href="/download/" title="Go the the Download page to see how to download Composer" aria-label="Go the the Download page to see how to download Composer">Download</a><a class="active" href="/doc/" title="View the Composer documentation" aria-label="View the Composer documentation">Documentation</a><a class="last" href="https://packagist.org/" title="Browse Composer packages on packagist.org (external link to Packagist.org)" aria-label="Browse Composer packages on packagist.org (external link to Packagist.org)">Browse Packages</a> </header> <main role="main"> <div id="main"> <div id="searchbar" class="clearfix"> <div id="docsearch"></div> </div> <ul class="toc"> </ul> <h1 id="how-do-i-install-composer-programmatically-">How do I install Composer programmatically?<a href="#how-do-i-install-composer-programmatically-" class="anchor">#</a></h1> <p>As noted on the download page, the installer script contains a checksum which changes when the installer code changes and as such it should not be relied upon in the long term.</p> <p>An alternative is to use this script which only works with UNIX utilities:</p> <pre><code class="language-bashell">#!/bin/sh EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')" php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ] then >&2 echo 'ERROR: Invalid installer checksum' rm composer-setup.php exit 1 fi php composer-setup.php --quiet RESULT=$? rm composer-setup.php exit $RESULT</code></pre> <p>The script will exit with 1 in case of failure, or 0 on success, and is quiet if no error occurs.</p> <p>Alternatively, if you want to rely on an exact copy of the installer, you can fetch a specific version from GitHub's history. The commit hash should be enough to give it uniqueness and authenticity as long as you can trust the GitHub servers. For example:</p> <pre><code class="language-bashell">wget https://raw.githubusercontent.com/composer/getcomposer.org/76a7060ccb93902cd7576b67264ad91c8a2700e2/web/installer -O - -q | php -- --quiet</code></pre> <p>You may replace the commit hash by whatever the last commit hash is on <a href="https://github.com/composer/getcomposer.org/commits/main">https://github.com/composer/getcomposer.org/commits/main</a></p> <p class="fork-and-edit"> Found a typo? Something is wrong in this documentation? <a href="https://github.com/composer/composer/edit/main/doc/faqs/how-to-install-composer-programmatically.md" title="Go to the docs to fork and propose updates (external link)" aria-label="Go to the docs to fork and propose updates (external link)">Fork and edit</a> it! </p> </div> </main> <footer> <p class="license"> Composer and all content on this site are released under the <a href="https://github.com/composer/composer/blob/main/LICENSE" title="View the MIT license (external link to GitHub.com)" aria-label="View the MIT license (external link to GitHub.com)">MIT license</a>. </p> </footer> </div> <script src="/build/app.js?v=2"></script> </body> </html>