I think we should specify only "loose" dependencies via install_requires. Requirements files are more usefull for "strict" dependencies, e.g. when building a web app based on libraries that don't guarantee API stability.  See e.g. this blog post:

I believe there's magic to get pip to automatically download dependencies based on install_requires whenever setup.py is invoked, but I could never figure out how to get it to work when I experimented with this in the past.  This also doesn't necessarily do much for us, since our dependencies in turn depend on C libraries that we have no way to install from within pip.