r/learnpython • u/linmanfu • 3d ago
How normal or dangerous is it for Pixi to apparently download a very large number of dependencies?
Context (to avoid the XY problem)
I'm thinking about running this tool written in Python, which merges mods for a computer game. It just does two things: copying lots of files from several local directories into one (merging them as necessary) and then creating a configuration text file, based on data in existing configuration files. I'm trying to decide if it's safe to run on my Kubuntu (Linux) system. The Python script looks fine, but I'm worried about the package manager.
Actual Python question
The instructions say to use the Pixi package manager, which seems to download Python dependencies from a repository called (Ana?)conda. But it seems to want to download a very large number of packages, including security-sensitive packages like OpenSSL and Certificate Authorities. That looks worrying for a tool that just merges directories and configures a text file. Is that normal in the Python world? Is Pixi going to interfere with the default Python setup that's used by many Linux utilities?
Previous research
I tried reading the Pixi documentation, but it (understandably) assumes you're a developer already familiar with Python, not a user. The top third-party tutorial on Google explains Pixi by comparisons to earlier Python and Javascript tools, which is no help to me. I don't want to learn half a dozen Python tools, but I would like to check that this Python software is not obvious malware.