I first generated a lockfile from an up-to-date dev environment with pipenv lock. Because the Pipfile only has sentry as an editable install requirement with all the extras, the lockfile can always be kept up to date without manual Pipfile editing or pipenv install calls - simply invoke pipenv lock after editing our requirements files which will get picked up by setuptools using our setup.py.

Basically, this PR adds a pipenv lockfile without really impacting our current workflow.

So the virtualenvs are nearly identical:

$ mkvirtualenv -p /Users/josh/.pyenv/versions/2.7.15/bin/python2.7 sentry
$ pip install -e ".[dev,tests,optional]"
$ pip freeze > /tmp/sentry
$ deactivate
$ mkvirtualenv -p /Users/josh/.pyenv/versions/2.7.15/bin/python2.7 sentry-pipenv
$ pipenv install
$ diff -u /tmp/sentry /tmp/sentry-pipenv
--- /tmp/sentry 2018-08-02 14:15:54.000000000 -0700
+++ /tmp/sentry-pipenv  2018-08-02 14:22:24.000000000 -0700
@@ -2,6 +2,7 @@
 anyjson==0.3.3
 apipkg==1.5
 asn1crypto==0.24.0
+atomicwrites==1.1.5
 attrs==18.1.0
 autopep8==1.3.5
 Babel==2.6.0

I don't really know why pipenv installed atomicwrites. It isn't a subdependency of anything, and so can be removed from the lockfile.