This is great, and a definite step up from the current requirements.txt. Why are the requirements like function calls though? Why can't they just keep a simple text format that's more human readable and editable, rather than something that just looks like a bunch of code? I think it's better in Ruby because you can omit parentheses and it looks cleaner, but my preference above both is package.json. Cargo is also really good. So in my eyes, moving to something like this is somewhat of a step backwards from requirements.txt, but taken together it looks like it will be better overall.

There are arguments for and against, but in general I think a configuration file should be human readable and editable, as well as easily understood by an IDE without having to run an interpreter. So something like YAML or TOML, or even a simple INI would be better than the function calls in the Pipfile. However, the lock file isn't meant to be edited by hand or really ever looked at, so it being in JSON or something less human readable is fine.

Also, why doesn't pip just make it, by default, look for the requirements.txt or the Pipfile? It's silly having to type pip install -r requirements.txt and I will also find it silly having to type pip -p. It's how NPM, Bundler, and many other package managers work; why do I need to call a flag to install requirements?