# composer mit Homebrew, apk, chocolatey, apt, dnf, pacman, scoop, zypper installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für composer in AI-Agent-Workflows.

## Installation

```sh
sudo av install brew:composer
```

## Antwort zur Agent-Sicherheit

composer manages PHP dependencies and package publishing workflows.

- **Credential-Zugriff:** Reads auth.json, repository tokens, environment variables, and project config.
- **Änderungen an Remote-Zustand:** Can install packages and run scripts that affect remote systems.
- **Publish-/Artefakt-Risiko:** Can publish packages or build deployable PHP artifacts.
- **Empfohlene Kontrolle:** Gate scripts, publish operations, and credentialed repository access.
- **Hinweise für Agent-Nutzung:** Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials.

Weitere Installationsbefehle:

### macOS

- Homebrew (100%):

```sh
brew install composer
```

  Evidenz: local Homebrew formula metadata

### Linux

- apk (92%):

```sh
sudo apk add composer
```

  Evidenz: Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Debian apt (92%):

```sh
sudo apt install composer
```

  Evidenz: Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- dnf (92%):

```sh
sudo dnf install composer
```

  Evidenz: Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- pacman (92%):

```sh
sudo pacman -S composer
```

  Evidenz: Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install php-composer
```

  Evidenz: openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Chocolatey (92%):

```sh
choco install composer
```

  Evidenz: Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cloudquery'

- Scoop (92%):

```sh
scoop install main/composer
```

  Evidenz: Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

## Paketfakten

- **Paketschlüssel:** brew:composer
- **Paketmanager:** Homebrew
- **Version:** 2.10.2
- **Quellzusammenfassung:** Dependency Manager for PHP
- **Homepage:** <https://getcomposer.org/>
- **Zuletzt aktualisiert:** 2026-07-01T13:09:12Z
- **Generiert:** 2026-08-03T19:37:03+00:00

## Executables

- composer (Alias)

## Installationsverhalten

- Bottle: nicht verfügbar

## Version und Aktualität

- Seite generiert: 2026-08-03
- Manager-Version: 2.10.2
## Projektgeschichte und Nutzung

Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager.

### Projektgeschichte

Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages.

### Adoptionsgeschichte

Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem.

### Wie es verwendet wird

Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew.

### Warum Paket-Nerds sich dafür interessieren

Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers.

### Zeitleiste

- 2012: Packagist records `composer/composer` 1.0.0-alpha1.
- 2013: GitHub releases include Composer 1.0.0-alpha1.
- 2016: Composer 1.0.0 was released.
- 2020: Composer 2.0.0 was released.
- 2026: Packagist continues to track active Composer 2.x development.

### Related projects

- Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design.

### Quellen

- <https://getcomposer.org/doc/00-intro.md>
- <https://github.com/composer/composer>
- <https://raw.githubusercontent.com/composer/composer/main/README.md>
- <https://packagist.org/packages/composer/composer.json>
- <https://github.com/composer/composer/releases/tag/1.0.0-alpha1>
- <https://github.com/composer/composer/releases/tag/1.0.0>
- <https://github.com/composer/composer/releases/tag/2.0.0>
- <https://getcomposer.org/doc/articles/authentication-for-private-packages.md>


## Sicherheitshinweise

infrastructure mutation or orchestration signal.

- **Geiger-Risiko:** orange / mittel
- infrastructure mutation or orchestration signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Credential files

- macOS: ~/Library/Application Support/Composer/auth.json
- Unix: $XDG_CONFIG_HOME/composer/auth.json, ~/.composer/auth.json
## Andere Paketmanager-Einträge

- Debian apt - composer - 2.8.8-1+deb13u3: normalized package name match | Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | dependency manager for PHP | https://getcomposer.org/
- Ubuntu apt - composer - 2.7.1-2: normalized package name match | Ubuntu 24.04 LTS package indexes: composer from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | dependency manager for PHP | https://getcomposer.org/
- apk - composer - 2.10.2-r0: normalized package name match | Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Dependency manager for PHP | https://getcomposer.org/
- apk - composer-bash-completion - 2.10.2-r0: normalized package name match | Alpine Linux edge package indexes: composer-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Bash completions for composer | https://getcomposer.org/
- dnf - composer - 2.10.2-2.fc45: normalized package name match | Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Dependency Manager for PHP | https://getcomposer.org/
- pacman - composer - 2.10.2-1: normalized package name match | Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Dependency Manager for PHP | https://getcomposer.org/
- zypper - php-composer - 1.10.26-2.8: normalized package name match | openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/
- zypper - php-composer2 - 2.10.2-3.1: normalized package name match | openSUSE Tumbleweed package metadata: php-composer2 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/
- Chocolatey - composer: normalized package name match | Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cloudquery'
- Scoop - main/composer: normalized package name match | Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/composer.yml](https://github.com/mxcl/pkgdb/blob/main/combined/composer.yml)


## Quellen

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph
- curated agent safety answer