Has anyone faced up an issue during magento installation with composer?

the command:

composer create-project --repository=https://repo.magento.com/ magento/project-community-edition m2
  • I had the same problem with vertex <b>during M2 upgrade from 2.2.7 to 2.3.0</b>. After the edit of composer.json you suggested, the command <b>composer update has completed successfully</b>. – Marco Laurito Dec 22 '18 at 14:52
  • This is not a resolution to the problem. Please see my comment under the accepted answer. – domdambrogia Dec 31 '18 at 21:38
  • are you solve this issue? – Mahi M Feb 26 '19 at 7:15
  • @ManoM , in a day or two I was able to install magento 2.3. As far as I understand, the shasum was corrected and therefore the problem disappeared – Boris Ruvinsky Feb 28 '19 at 11:06

That is a problem on the Magento side.

The composer.json in the Composer cache expects that:

"dist": {
      "type": "zip",
      "url": "https://repo.magento.com/archives/vertex/module-tax/vertex-module-tax-",
      "reference": null,
      "shasum": "5301f7a4d294cabcab3ae83e31fe5386c076520c"

I downloaded the "vertex-module-tax-". The shasum is dd5e23680878e70fdff546fa661822b100ab2bf3 which is different. That's why composer stops the download.

  • 1
    I would like to point out the obvious security vulnerability with this. The shasum is in place to confirm the packaged files are what you "expect". By updating the shasum to hide the error, you are acknowledging you could be using malicious files. – domdambrogia Dec 31 '18 at 21:37

Vertex is not a core magento module and can be remove in your composer.json. Insert this under require-dev{}

"replace": {
        "vertex/module-tax": "*",
  • "replace": { "vertex/module-tax": "*", } – alexey boltynov Jan 21 '20 at 9:32

The genesis of the problem is in changing module files inside same public version. This is bad practise and I feel shame for people, who made it happen.

Same problem occurred in the past for the magento/composer module.

To truly make it work, without changing of hashes (which is somewhat unacceptable, for professionals, because it may not work due to of the cached files, which may differ on multiple machines):

  1. rm -rf vendor/vertex
  2. rm -rf ~/.cache/composer/files/vertex or rm -rf ~/.composer/cache/files/vertex (depeneds on OS)
  3. composer update vertex/module-tax

That will download new zip, with different checksum.

If you using multiserver infrastructure, you should clear that specific cache files on each of your machines.

Read more on the topic here: https://github.com/magento/magento2/issues/19283

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.