If you’re trying to install some PHP tool and it keeps saying “run this with Composer”, but your Debian 10 server just shrugs, this one’s for you.

Before: you copy-paste commands from a GitHub README, get a Composer error, and nothing works.
After: Composer is installed, verified, and you can install PHP packages and frameworks without guessing.

This guide is focused on Debian 10 and sticks closely to what we know from the original reference. No magic, just clear steps.

Who This Is For (And What You’ll Need)

This guide is for you if:
– You’re on a Debian 10 server.
– You have a regular user with sudo privileges.
– You want Composer installed cleanly and safely.

We’re assuming the basic Debian 10 initial server setup is already done (user created, sudo access working). If sudo doesn’t work for you yet, fix that first before touching Composer.

We’ll go through:
– Installing the required system packages.
– Downloading the Composer installer.
– Verifying the installer with a SHA-384 hash.
– Running the installer.
– Basic ideas of how you’ll use Composer afterward.

Step 1: Update Your Package List

Always start by updating the package index so you’re not pulling stale package info.

Run this:

sudo apt update

Why this matters: Debian needs a fresh package list so when you install PHP and other tools, you get the versions your repositories actually know about. It also avoids some annoying “package not found” or outdated dependency issues.

Step 2: Install Required Dependencies

Composer itself is written in PHP, and it needs several tools around it to work properly.

Install everything in one go:

sudo apt install curl php-cli php-mbstring git unzip

What each package is for (short and sweet):
– curl – used to download the Composer installer.
– php-cli – lets you run PHP from the command line, which is how Composer runs.
– php-mbstring – provides multibyte string functions needed by a library Composer uses.
– git – Composer uses Git to download many project dependencies.
– unzip – used to extract packages that come as zip archives.

If any of these fail to install, fix that first before you continue. Composer will break or behave weirdly without them.

Step 3: Download the Composer Installer

Now we’ll grab the official Composer installer script.

First, move to your home directory so everything lands in a sane place:

cd ~

Then download the installer with curl:

curl -sS https://getcomposer.org/installer -o composer-setup.php

Quick notes:
– -sS makes curl quiet but still prints errors.
– -o composer-setup.php saves the file with a clear name.

After this, you should have a composer-setup.php file in your home directory.

Step 4: Verify the Installer Using SHA-384

This step is about safety.

Instead of trusting that composer-setup.php is clean, we compare its hash with the official one from the Composer site. If they match, you’re good. If not, stop.

1. Go to the Composer Public Keys / Signatures page in your browser (the reference guide points there for the latest installer hash).
2. Copy the SHA-384 hash for the latest installer.
3. Store it in a shell variable. For example, using the hash shown in the source:

HASH=48e3236262b34d30969dca3c37281b3b4bbe3221bda826ac6a9a62d6444cdb0dcd0615698a5cbe587c3f0fe57a54d8f5

Make sure:
– You copy the hash exactly.
– You’re using the hash for the current installer version.

If you mess up the hash, the verification will fail even if the file is fine, so double-check your copy-paste.

Step 5: (From Here) Follow the Official Verification and Install Steps

The original source continues from this point by having you compare the hash you just saved against the hash of the composer-setup.php file, and then run the installer if it matches.

Because the rest of the exact commands and steps aren’t fully included in the snippet we have, I won’t guess or invent details. Composer’s install and verify process is sensitive, and you really don’t want to run a corrupted or tampered installer.

From here, do this:

1. On your Debian 10 server, with composer-setup.php downloaded and the HASH variable set as above, follow the remaining steps from the same guide/source you’re using.
2. Those remaining steps will:
3. Compare the calculated SHA-384 of composer-setup.php with $HASH.
4. Exit with an error if the hashes don’t match.
5. Run the installer with PHP if the hashes match, so Composer is installed.

Once the official install script completes, you’ll have Composer installed and ready to use on Debian 10.

What You Can Do After Composer Is Installed

Once Composer is in place, you can:
– Install project dependencies defined in a composer.json file.
– Update dependencies to versions allowed by that file.
– Bootstrap new projects based on popular PHP frameworks like Symfony or Laravel.

Composer will:
– Check which packages your project depends on.
– Pull them in using versions that match the project’s requirements.

This is why so many PHP tools and frameworks tell you to “install via Composer” — it keeps dependency handling consistent and automatic.

Safety Tips and Next Steps

A few quick safety reminders around Composer:

• Always verify the installer hash using the official hash for the current installer version.
• Only run Composer in project directories you trust, especially when installing dependencies from composer.json.
• If you’re working on a live server, test any big dependency updates on a staging environment first so you don’t break a production site.

If Composer is now installed and working on your Debian 10 server, you’re in a good spot to follow framework-specific docs (Laravel, Symfony, etc.) or project README files that rely on Composer.

If this worked for you, keep CrushEdge handy for the next fix.