# composer を Homebrew, apk, chocolatey, apt, dnf, pacman, scoop, zypper でインストール

composer のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

## インストール

```sh
sudo av install brew:composer
```

## エージェント安全性の回答

composer manages PHP dependencies and package publishing workflows.

- **認証情報アクセス:** Reads auth.json, repository tokens, environment variables, and project config.
- **リモート変更:** Can install packages and run scripts that affect remote systems.
- **公開/成果物リスク:** Can publish packages or build deployable PHP artifacts.
- **推奨コントロール:** Gate scripts, publish operations, and credentialed repository access.
- **エージェント利用ガイダンス:** Allow dependency inspection; require approval for scripts, publishes, and private-repo credentials.

追加のインストールコマンド:

### macOS

- Homebrew (100%):

```sh
brew install composer
```

  証拠: local Homebrew formula metadata

### Linux

- apk (92%):

```sh
sudo apk add composer
```

  証拠: Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Debian apt (92%):

```sh
sudo apt install composer
```

  証拠: Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- dnf (92%):

```sh
sudo dnf install composer
```

  証拠: Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- pacman (92%):

```sh
sudo pacman -S composer
```

  証拠: Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install php-composer
```

  証拠: openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Chocolatey (92%):

```sh
choco install composer
```

  証拠: Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cloudquery'

- Scoop (92%):

```sh
scoop install main/composer
```

  証拠: Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

## パッケージ情報

- **パッケージキー:** brew:composer
- **パッケージマネージャ:** Homebrew
- **バージョン:** 2.10.2
- **ソース概要:** Dependency Manager for PHP
- **ホームページ:** <https://getcomposer.org/>
- **最終更新:** 2026-07-01T13:09:12Z
- **生成日時:** 2026-08-03T19:37:03+00:00

## 実行可能ファイル

- composer (エイリアス)

## インストール挙動

- Bottle: 利用不可

## バージョンと鮮度

- ページ生成日: 2026-08-03
- マネージャ版: 2.10.2
## プロジェクトの歴史と使われ方

Composer is the standard dependency manager for PHP projects. It lets projects declare library dependencies, resolves installable versions, and installs packages into the project rather than acting like a system package manager.

### プロジェクトの歴史

Composer was created by Nils Adermann and Jordi Boggiano and released under the MIT license. Official documentation describes it as inspired by npm and Bundler, bringing per-project dependency resolution and installation to PHP. Packagist serves as the public package index for Composer packages.

### 採用の歴史

Packagist records `composer/composer` package versions starting with 1.0.0-alpha1 in 2012, and GitHub releases include 1.0.0-alpha1 in 2013. The official README points users to Packagist for public packages and to Private Packagist for private hosting, showing how Composer became both a CLI and a package ecosystem.

### 使われ方

Normal Composer usage starts with a project `composer.json`, produces a lock file for reproducible installs, and installs dependencies into `vendor`. It can be installed locally as a PHAR, globally on PATH, through Docker, or through OS package managers such as Homebrew.

### パッケージ好きにとっての重要性

Composer is package-manager infrastructure, not just a CLI. Its resolver, lock file, Packagist integration, authentication model, and VCS support made PHP packages installable with dependency constraints in a way familiar to users of npm, Bundler, and other language package managers.

### タイムライン

- 2012: Packagist records `composer/composer` 1.0.0-alpha1.
- 2013: GitHub releases include Composer 1.0.0-alpha1.
- 2016: Composer 1.0.0 was released.
- 2020: Composer 2.0.0 was released.
- 2026: Packagist continues to track active Composer 2.x development.

### Related projects

- Composer is closely tied to Packagist, Private Packagist, PHP's PHAR distribution model, and language package managers such as npm and Bundler that influenced its design.

### ソース

- <https://getcomposer.org/doc/00-intro.md>
- <https://github.com/composer/composer>
- <https://raw.githubusercontent.com/composer/composer/main/README.md>
- <https://packagist.org/packages/composer/composer.json>
- <https://github.com/composer/composer/releases/tag/1.0.0-alpha1>
- <https://github.com/composer/composer/releases/tag/1.0.0>
- <https://github.com/composer/composer/releases/tag/2.0.0>
- <https://getcomposer.org/doc/articles/authentication-for-private-packages.md>


## セキュリティノート

infrastructure mutation or orchestration signal.

- **Geiger リスク:** orange / 中
- infrastructure mutation or orchestration signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Credential files

- macOS: ~/Library/Application Support/Composer/auth.json
- Unix: $XDG_CONFIG_HOME/composer/auth.json, ~/.composer/auth.json
## 他のパッケージマネージャ記録

- Debian apt - composer - 2.8.8-1+deb13u3: normalized package name match | Debian stable package indexes: composer from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | dependency manager for PHP | https://getcomposer.org/
- Ubuntu apt - composer - 2.7.1-2: normalized package name match | Ubuntu 24.04 LTS package indexes: composer from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | dependency manager for PHP | https://getcomposer.org/
- apk - composer - 2.10.2-r0: normalized package name match | Alpine Linux edge package indexes: composer from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Dependency manager for PHP | https://getcomposer.org/
- apk - composer-bash-completion - 2.10.2-r0: normalized package name match | Alpine Linux edge package indexes: composer-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Bash completions for composer | https://getcomposer.org/
- dnf - composer - 2.10.2-2.fc45: normalized package name match | Fedora Rawhide package metadata: composer from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Dependency Manager for PHP | https://getcomposer.org/
- pacman - composer - 2.10.2-1: normalized package name match | Arch Linux sync databases: composer from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Dependency Manager for PHP | https://getcomposer.org/
- zypper - php-composer - 1.10.26-2.8: normalized package name match | openSUSE Tumbleweed package metadata: php-composer from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/
- zypper - php-composer2 - 2.10.2-3.1: normalized package name match | openSUSE Tumbleweed package metadata: php-composer2 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Dependency Management for PHP | https://getcomposer.org/
- Chocolatey - composer: normalized package name match | Chocolatey community package catalog: composer from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','cloudquery'
- Scoop - main/composer: normalized package name match | Scoop official bucket manifest trees: bucket/composer.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/composer.yml](https://github.com/mxcl/pkgdb/blob/main/combined/composer.yml)


## ソース

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph
- curated agent safety answer