We have a MediaWiki update procedure at Website | mediawiki-install.txt. MediaWiki requires the use of developer tools like Composer on a production server. It is a bad idea, but we cannot change it.

Step 7 requires us to run Composer and update dependencies.

php -d extension=phar.so composer.phar update

When the command executes it produces the following error:

# php -d extension=phar.so composer.phar update
Do not run Composer as root/super user! See https://getcomposer.org/root for details
> ComposerHookHandler::onPreUpdate
Loading composer repositories with package information
Updating dependencies (including require-dev)

According to https://getcomposer.org/root, the fix is:

composer install --no-plugins --no-scripts ...
composer update --no-plugins --no-scripts ...

I tried to examine composer.phar to see what our options are but it is binary data:

# grep 'composer' composer.phar
Binary file composer.phar matches
# file composer.phar
composer.phar: data

My question is, how do we run composer.phar and ensure the source file does what is advised?

1 Answer 1


Do not run Composer in production. Run it on a deploy host, and then depending on your level of paranoia either use rsync/ftp/scp/etc to upload the files to production, or commit them to a deploy repo which production can pull from after manual review.

  • Thanks Tgr. I tried that last year. We don't have a compatible image. I even tried to figure out a way to clone the remote image locally without success.
    – user40589
    Jun 7, 2019 at 17:46
  • I'm not sure what you mean by "image". Some kind of containerization? Composer doesn't really care about what OS it is running on.
    – Tgr
    Jun 8, 2019 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.