Has anyone faced up an issue during magento installation with composer?

the command:

composer create-project --repository=https://repo.magento.com/ magento/project-community-edition m2
  • I had the same problem with vertex <b>during M2 upgrade from 2.2.7 to 2.3.0</b>. After the edit of composer.json you suggested, the command <b>composer update has completed successfully</b>. Commented Dec 22, 2018 at 14:52
  • This is not a resolution to the problem. Please see my comment under the accepted answer. Commented Dec 31, 2018 at 21:38
  • are you solve this issue?
    – Mahi M
    Commented Feb 26, 2019 at 7:15
  • @ManoM , in a day or two I was able to install magento 2.3. As far as I understand, the shasum was corrected and therefore the problem disappeared Commented Feb 28, 2019 at 11:06

4 Answers 4


That is a problem on the Magento side.

The composer.json in the Composer cache expects that:

"dist": {
      "type": "zip",
      "url": "https://repo.magento.com/archives/vertex/module-tax/vertex-module-tax-",
      "reference": null,
      "shasum": "5301f7a4d294cabcab3ae83e31fe5386c076520c"

I downloaded the "vertex-module-tax-". The shasum is dd5e23680878e70fdff546fa661822b100ab2bf3 which is different. That's why composer stops the download.

  • 1
    I would like to point out the obvious security vulnerability with this. The shasum is in place to confirm the packaged files are what you "expect". By updating the shasum to hide the error, you are acknowledging you could be using malicious files. Commented Dec 31, 2018 at 21:37

Vertex is not a core magento module and can be remove in your composer.json. Insert this under require-dev{}

"replace": {
        "vertex/module-tax": "*",
  • "replace": { "vertex/module-tax": "*", } Commented Jan 21, 2020 at 9:32

The genesis of the problem is in changing module files inside same public version. This is bad practise and I feel shame for people, who made it happen.

Same problem occurred in the past for the magento/composer module.

To truly make it work, without changing of hashes (which is somewhat unacceptable, for professionals, because it may not work due to of the cached files, which may differ on multiple machines):

  1. rm -rf vendor/vertex
  2. rm -rf ~/.cache/composer/files/vertex or rm -rf ~/.composer/cache/files/vertex (depeneds on OS)
  3. composer update vertex/module-tax

That will download new zip, with different checksum.

If you using multiserver infrastructure, you should clear that specific cache files on each of your machines.

Read more on the topic here: https://github.com/magento/magento2/issues/19283


Try to reinstall composer. That was the solution for me on Mac.


brew reinstall composer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.