# composer を Homebrew, apk, chocolatey, apt, dnf, pacman, scoop, zypper でインストール composer のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:composer ``` ## エージェント安全性の回答 composer manages PHP dependencies and package publishing workflows. - **認証情報アクセス:** Reads auth.json, repository tokens, environment variables, and project config. - **リモート変更:** Can install packages and run scripts that affect remote systems. - **公開/成果物リスク:** Can publish packages or build deployable PHP artifacts. - **推奨コントロール:** Gate scripts, publish operations, and credentialed repository access. - **エージェント利用ガイダンス:** Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials. 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install composer ``` 証拠: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add composer ``` 証拠: Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install composer ``` 証拠: Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install composer ``` 証拠: Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/210a2053c8e007daf9ae39c2a21daaed9b2ddd07d63ecffa597050361e73650c-primary.xml.zst - pacman (92%): ```sh sudo pacman -S composer ``` 証拠: Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install php-composer ``` 証拠: openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install composer ``` 証拠: Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cloudquery' - Scoop (92%): ```sh scoop install main/composer ``` 証拠: Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## パッケージ情報 - **パッケージキー:** brew:composer - **パッケージマネージャ:** Homebrew - **パッケージマネージャページ:** - **バージョン:** 2.10.2 - **ソース概要:** Dependency Manager for PHP - **ホームページ:** - **上流ドキュメント:** - **ライセンス:** MIT - **ソースアーカイブ:** - **最終更新:** 2026-07-01T13:09:12Z - **生成日時:** 2026-08-04T22:13:35+00:00 ## 実行可能ファイル - composer (cli) - composer (エイリアス) ## 依存関係 - php ## インストール挙動 - post-install フック: 未定義 - Bottle: 利用可能 対象 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## バージョンと鮮度 - ページ生成日: 2026-08-04 - マネージャ版: 2.10.2 - マネージャ更新日: 2026-07-01 - ローカルデータ: OK - 上流リポジトリ: https://getcomposer.org/ - 情報: Release/tag comparison is only available for GitHub repositories. ## プロジェクトの歴史と使われ方 Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager. ### プロジェクトの歴史 Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages. ### 採用の歴史 Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem. ### 使われ方 Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew. ### パッケージ好きにとっての重要性 Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers. ### タイムライン - 2012: Packagist records `composer/composer` 1.0.0-alpha1. - 2013: GitHub releases include Composer 1.0.0-alpha1. - 2016: Composer 1.0.0 was released. - 2020: Composer 2.0.0 was released. - 2026: Packagist continues to track active Composer 2.x development. ### Related projects - Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design. ### ソース - - - - - - - - ## セキュリティノート infrastructure mutation or orchestration signal. - **Geiger リスク:** orange / 中 - infrastructure mutation or orchestration signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Credential files - macOS: ~/Library/Application Support/Composer/auth.json - Unix: $XDG_CONFIG_HOME/composer/auth.json, ~/.composer/auth.json ## ソースデータベース詳細 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** composer - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## 他のパッケージマネージャ記録 - Debian apt - composer - 2.8.8-1+deb13u3: normalized package name match | Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | dependency manager for PHP | https://getcomposer.org/ - Ubuntu apt - composer - 2.7.1-2: normalized package name match | Ubuntu 24.04 LTS package indexes: composer from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | dependency manager for PHP | https://getcomposer.org/ - apk - composer - 2.10.2-r0: normalized package name match | Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Dependency manager for PHP | https://getcomposer.org/ - apk - composer-bash-completion - 2.10.2-r0: normalized package name match | Alpine Linux edge package indexes: composer-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Bash completions for composer | https://getcomposer.org/ - dnf - composer - 2.10.2-2.fc45: normalized package name match | Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/210a2053c8e007daf9ae39c2a21daaed9b2ddd07d63ecffa597050361e73650c-primary.xml.zst | Dependency Manager for PHP | https://getcomposer.org/ - pacman - composer - 2.10.2-1: normalized package name match | Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Dependency Manager for PHP | https://getcomposer.org/ - zypper - php-composer - 1.10.26-2.8: normalized package name match | openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/ - zypper - php-composer2 - 2.10.2-3.1: normalized package name match | openSUSE Tumbleweed package metadata: php-composer2 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/ - Chocolatey - composer: normalized package name match | Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cloudquery' - Scoop - main/composer: normalized package name match | Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## 関連リンク - [Package publisher tools](https://pkg.so/ja/package-publishers/) - Belongs to a package publishing or registry command family. - [Secret-risk packages](https://pkg.so/ja/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://pkg.so/ja/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://pkg.so/ja/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [php](https://pkg.so/ja/brew/php/) - Runtime dependency declared by Homebrew. - [phive](https://pkg.so/ja/brew/phive/) - Shares pkgdb curated category or tags: cli, developer-tools, package-management, php. - [mint](https://pkg.so/ja/brew/mint/) - Shares pkgdb curated category or tags: cli, dependency-manager, developer-tools, package-management, package-manager. - [nuget](https://pkg.so/ja/brew/nuget/) - Shares pkgdb curated category or tags: cli, developer-tools, package-management, package-manager, packages. - [conan](https://pkg.so/ja/brew/conan/) - Shares pkgdb curated category or tags: cli, dependency-manager, developer-tools, package-management, package-manager. - [pnpm](https://pkg.so/ja/brew/pnpm/) - Shares pkgdb curated category or tags: cli, developer-tools, package-management, package-manager. - [poetry](https://pkg.so/ja/brew/poetry/) - Shares pkgdb curated category or tags: cli, developer-tools, package-management, package-manager. - [cask](https://pkg.so/ja/brew/cask/) - Shares pkgdb curated category or tags: cli, dependency-manager, developer-tools, package-management. - [pixi](https://pkg.so/ja/brew/pixi/) - Shares pkgdb curated category or tags: cli, developer-tools, package-management, package-manager. ## Combined YAML source View the package source record on GitHub. [combined/composer.yml](https://github.com/mxcl/pkgdb/blob/main/combined/composer.yml) ## ソース - pkg.so package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph - curated agent safety answer