diff --git a/bindep.txt b/bindep.txt
new file mode 100644
index 0000000000..7071c188bc
--- /dev/null
+++ b/bindep.txt
@@ -0,0 +1,41 @@
+# This is a cross-platform list tracking distribution packages needed for install and tests;
+# see https://docs.openstack.org/infra/bindep/ for additional information.
+
+mysql-server [platform:dpkg]
+mariadb-server [platform:redhat]
+postgresql
+
+build-essential [platform:dpkg]
+python-dev [platform:dpkg]
+python3-all-dev [platform:dpkg]
+libxml2-dev [platform:dpkg]
+libxslt1-dev [platform:dpkg]
+libyaml-dev [platform:dpkg]
+libssl-dev [platform:dpkg]
+libffi-dev [platform:dpkg]
+libmysqlclient-dev [platform:dpkg]
+libpq-dev [platform:dpkg]
+mysql-client [platform:dpkg]
+postgresql-client [platform:dpkg]
+
+gcc [platform:rpm]
+python-devel [platform:rpm]
+python3-devel [platform:fedora platform:suse]
+python3 [platform:suse]
+libxml2-devel [platform:rpm]
+libxslt-devel [platform:rpm]
+libyaml-devel [platform:rpm]
+openssl-devel [platform:rpm]
+libffi-devel [platform:redhat platform:suse !platform:opensuse423]
+libffi48-devel [platform:opensuse423]
+mariadb-devel [platform:redhat]
+libmysqlclient-devel [platform:suse]
+postgresql-devel [platform:rpm]
+
+dev-libs/libxml2 [platform:gentoo]
+dev-libs/libxslt [platform:gentoo]
+dev-libs/libyaml [platform:gentoo]
+dev-libs/openssl [platform:gentoo]
+virtual/libffi [platform:gentoo]
+dev-db/mariadb [platform:gentoo]
+
diff --git a/test-requirements.txt b/test-requirements.txt
index 77ffd67104..3d0fb48d05 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -4,7 +4,7 @@
 
 # Hacking already pins down pep8, pyflakes and flake8
 hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
-bandit!=1.6.0,>=1.1.0 # Apache-2.0
+bandit<1.6.0,>=1.1.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
 kombu!=4.0.2,>=4.0.0 # BSD
diff --git a/tox.ini b/tox.ini
index a0543bb74f..fc31cfde80 100644
--- a/tox.ini
+++ b/tox.ini
@@ -104,3 +104,15 @@ commands = oslo_debug_helper {posargs}
 
 [testenv:releasenotes]
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
+
+[testenv:bindep]
+basepython = python3
+# Do not install any requirements. We want this to be fast and work even if
+# system dependencies are missing, since it's used to tell you what system
+# dependencies are missing! This also means that bindep must be installed
+# separately, outside of the requirements files, and develop mode disabled
+# explicitly to avoid unnecessarily installing the checked-out repo too (this
+# further relies on "tox.skipsdist = True" above).
+deps = bindep
+commands = bindep test
+usedevelop = False