pants used to depend on lockfile (==0.10.2, then later ==0.12.2). So we owned that pinned dep for pants <= 0.0.79. The lockfile dep on pbr, the problem child, is owned by ... openstack?