How to Install Composer on Fedora Linux

PHP projects drift fast when each machine resolves a different dependency tree. You can install Composer on Fedora from the official repositories or with the upstream installer, then use it to lock package versions, pull dependencies from Packagist, and keep deployments predictable.

Fedora already packages Composer in the official repositories, so DNF is the practical default for most systems. The upstream installer still makes sense if you want Composer’s own self-update channel or you prefer the binary in /usr/local/bin instead of the distro package path.

Install Composer on Fedora

Two installation paths fit most Fedora systems. The Fedora package keeps Composer on the distro’s package lifecycle, while the upstream installer follows Composer’s own update channel from getcomposer.org.

Method	Channel	Version on Fedora 43	Updates	Best For
Fedora package	Fedora repositories	Composer 2.9.5, currently matching upstream	System-managed through DNF	Most users who want the lowest-maintenance setup
Official installer	Composer upstream	Latest upstream 2.9.x	Manual with sudo composer self-update	Users who want Composer’s own update channel or a /usr/local/bin install

On Fedora 43 the packaged build already matches the current upstream 2.9.5 release, so the DNF method is the practical recommendation right now. The manual method is still worth covering because that can change later, and some users prefer Composer’s own update path from the start.

Use one installation method at a time. A manual install in /usr/local/bin/composer overrides the Fedora package in /usr/bin/composer, which makes updates and removals harder to track if both are present.

Update Fedora Before Installing Composer

Refresh package metadata and install any pending Fedora updates before you add Composer to the system:

sudo dnf upgrade --refresh

These commands use sudo for tasks that need root privileges. If your account is not in the sudoers file yet, follow the guide on how to add a user to sudoers on Fedora before continuing.

Install Composer from Fedora Repositories

The Fedora package is the low-maintenance option because DNF keeps Composer aligned with the rest of your system packages.

sudo dnf install composer -y

The -y flag accepts DNF’s confirmation prompt automatically, which keeps the command copy-ready for fresh systems and remote shells. On Fedora 43, this transaction also pulled in php-cli and the PHP modules Composer needed, so there was no separate CLI setup step just to get Composer running. If you need the broader runtime for web applications or PHP-FPM work, follow the guide to install PHP on Fedora.

The same DNF syntax applies to the rest of Fedora’s package management too, so DNF5 install examples on Fedora is a useful companion if you want the wider search, install, and upgrade patterns.

First confirm that DNF registered both the Composer package and the PHP CLI runtime it uses:

rpm -q composer php-cli

composer-2.9.5-1.fc43.noarch
php-cli-8.4.19-1.fc43.x86_64

Then check the active Composer binary from your shell:

composer --version

Composer version 2.9.5 2026-01-29 11:40:53
PHP version 8.4.19 (/usr/bin/php)
Run the "diagnose" command to get more detailed diagnostics output.

composer self-update is not available in the Fedora package. Keep the DNF update path if you install Composer this way.

Install Composer with the Official Installer on Fedora

The upstream installer is the better fit when you want Composer’s own release channel instead of Fedora’s package lifecycle. Remove the Fedora package first if which -a composer already shows /usr/bin/composer and you want one clear update path.

Fedora Workstation often already has curl, git, and unzip, but server and minimal installs usually need the full prerequisite set. Install the PHP CLI modules and tools the upstream binary depends on before you fetch the installer:

sudo dnf install php-cli php-process php-xml php-mbstring php-intl php-pecl-zip curl git unzip -y

These PHP packages mirror the CLI modules Fedora’s own Composer package pulled automatically, so the upstream binary starts with the same runtime support. The upstream method uses the curl command in Linux to download the installer and its published signature.

Download the installer into your current working directory:

curl -sS https://getcomposer.org/installer -o composer-setup.php

Then compare that file against the current SHA-384 signature published by Composer:

HASH="$(curl -sS https://composer.github.io/installer.sig)"
php -r "if (hash_file('sha384', 'composer-setup.php') === '$HASH') { echo 'Installer verified' . PHP_EOL; } else { echo 'Installer corrupt' . PHP_EOL; unlink('composer-setup.php'); exit(1); }"

Installer verified

The first line stores Composer’s published SHA-384 signature in the HASH shell variable, then the PHP one-liner compares that value against the file you just downloaded.

Install Composer globally so the composer command works from anywhere on the system:

sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer

All settings correct for using Composer
Downloading...

Composer (version 2.9.5) successfully installed to: /usr/local/bin/composer
Use it: php /usr/local/bin/composer

Remove the installer script and confirm the global binary is active in your shell:

rm composer-setup.php
composer --version

Composer version 2.9.5 2026-01-29 11:40:53
PHP version 8.4.19 (/usr/bin/php)
Run the "diagnose" command to get more detailed diagnostics output.

A global install in /usr/local/bin/composer is owned by root, so later updates use sudo composer self-update. If you install Composer somewhere inside your home directory instead, drop sudo for updates.

Run Your First Composer Commands on Fedora

After either install method, use Composer inside a project directory as your regular user, not as root. Composer writes composer.json, composer.lock, and the vendor/ tree into the current project, so keeping those files owned by your login account avoids permission cleanup later.

Create a Composer Project on Fedora

Start in an empty working directory and generate a minimal Composer project without interactive prompts:

mkdir composer-demo
cd composer-demo
composer init --name=linuxcapable/composer-demo --description="Composer quickstart demo" --author="LinuxCapable <demo@example.com>" --type=project --license=MIT --no-interaction

The --no-interaction flag writes a baseline composer.json immediately, which makes this workflow easier to reuse in scripts and remote sessions. Validate the new manifest before you add packages:

composer validate

./composer.json is valid

Add a Dependency with Composer on Fedora

Add a package with composer require when you want Composer to update both composer.json and composer.lock in one step:

composer require monolog/monolog --no-interaction

Relevant output includes:

./composer.json has been updated
Running composer update monolog/monolog
Loading composer repositories with package information
Updating dependencies
Lock file operations: 2 installs, 0 updates, 0 removals
  - Locking monolog/monolog (3.10.0)
  - Locking psr/log (3.0.2)
Writing lock file
Installing dependencies from lock file (including require-dev)
Generating autoload files
No security vulnerability advisories found.
Using version ^3.10 for monolog/monolog

Confirm the resolved package after the install finishes:

composer show monolog/monolog

Relevant output includes:

name     : monolog/monolog
descrip. : Sends your logs to files, sockets, inboxes, databases and various web services
keywords : log, logging, psr-3
versions : * 3.10.0
released : 2026-01-02, 2 months ago
type     : library
license  : MIT License (MIT) (OSI approved) https://spdx.org/licenses/MIT.html#licenseText
homepage : https://github.com/Seldaek/monolog

Most Packagist downloads arrive as archives, but private repositories and some fallback flows still use Git sources. If your project relies on that workflow, install Git on Fedora before you start pulling VCS dependencies.

Install Dependencies from an Existing Composer Lock File on Fedora

When you clone a repository that already includes composer.json and composer.lock, use composer install instead of composer require. That recreates the exact dependency set recorded by the project.

composer install --no-interaction

Relevant output includes:

Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Package operations: 2 installs, 0 updates, 0 removals
  - Installing psr/log (3.0.2): Extracting archive
  - Installing monolog/monolog (3.10.0): Extracting archive
Generating autoload files
1 package you are using is looking for funding.
Use the `composer fund` command to find out more!

Most teams commit composer.json and composer.lock to version control, then rebuild vendor/ locally or in CI with composer install. That keeps every machine on the same dependency graph.

Check Platform Requirements and Security Advisories with Composer on Fedora

Two quick diagnostics catch the most common project-level issues after the first install: missing platform requirements and vulnerable packages.

composer check-platform-reqs
composer audit

Checking platform requirements for packages in the vendor dir
php 8.4.19   success 

No security vulnerability advisories found.

Update or Remove Composer on Fedora

The correct maintenance command depends on how you installed Composer, so keep the Fedora package and upstream workflows separate.

Update Fedora-Installed Composer on Fedora

The Fedora package updates through DNF, not through Composer’s own self-update command.

sudo dnf upgrade --refresh composer -y

Check the package state after the DNF transaction finishes:

rpm -q composer

composer-2.9.5-1.fc43.noarch

The Fedora package keeps Composer under DNF, so the self-update command remains unavailable on this path:

This instance of Composer does not have the self-update command.
This could be due to a number of reasons, such as Composer being installed as a system package on your OS, or Composer being installed as a package in the current project.

Update a Manually Installed Composer on Fedora

A global upstream install in /usr/local/bin/composer needs sudo for updates because root owns the binary.

sudo composer self-update

Relevant output includes:

You are already using the latest available Composer version 2.9.5 (stable channel).

If you installed Composer into a user-owned path instead, drop sudo for updates.

Remove Fedora-Installed Composer on Fedora

Use DNF removal only when Composer came from Fedora’s package repositories.

sudo dnf remove composer -y

Verify that the package is gone:

rpm -q composer

package composer is not installed

Remove a Manually Installed Composer on Fedora

This path assumes the upstream installer is the only Composer binary you kept on the system. Remove the file from /usr/local/bin, then confirm that manual binary is gone:

sudo rm -f /usr/local/bin/composer
test ! -x /usr/local/bin/composer && echo Manual Composer removed

Manual Composer removed

If the PHP CLI stack was installed only for the manual Composer method and nothing else on the host needs it, remove those packages separately. Leave them in place if you still use PHP for anything else.

sudo dnf remove php-cli php-process php-xml php-mbstring php-intl php-pecl-zip -y

Both methods can leave the per-user cache and metadata directory behind. Remove that only if you are finished with Composer entirely for your account:

rm -rf ~/.composer

Troubleshoot Composer on Fedora

These checks fix the two issues most likely after you add a second install method: no Composer binary at all, or two Composer binaries competing on your PATH.

Fix Composer Command Not Found on Fedora

The shell error looks like this:

bash: composer: command not found

If you planned to use the Fedora package, confirm the package state first:

rpm -q composer

package composer is not installed

Reinstall the package, then verify the binary again:

sudo dnf install composer -y
composer --version

Composer version 2.9.5 2026-01-29 11:40:53
PHP version 8.4.19 (/usr/bin/php)
Run the "diagnose" command to get more detailed diagnostics output.

If you chose the manual method instead, rerun the upstream installer section and confirm that /usr/local/bin/composer exists before you try again.

Fix Composer Path Conflicts on Fedora

Mixed installs are the more confusing case. A manual install in /usr/local/bin overrides the Fedora package in /usr/bin, even when both are present and both work.

which -a composer

If both methods are installed, output includes:

/usr/local/bin/composer
/usr/bin/composer

Keep only one path. Remove the Fedora package if you want the manual install in /usr/local/bin, or remove /usr/local/bin/composer if you want the Fedora package in /usr/bin to win.

# Keep the manual install
sudo dnf remove composer -y

# Keep the Fedora package
sudo rm -f /usr/local/bin/composer

After cleanup, which -a composer should return one path only.

Conclusion

Composer is running on Fedora with either DNF managing the package or the upstream installer keeping the binary in /usr/local/bin. Stick to one update path, then put it to work on a real project and add automated coverage with install PHPUnit on Fedora.