task: metadata: install: pip install -e .[dev]
patch: diff --git a/README.rst b/README.rst
index 367570c..c2389f4 100644
--- a/README.rst
+++ b/README.rst
@@ -270,6 +270,9 @@ put it directly into ``pip``.
 Version History
 ===============
 
+  * Preserve indented comments when updating requirements files.
+    See https://github.com/peterbe/hashin/issues/124
+
   * Switch to GitHub Actions instead of TravisCI. And test ``tox`` in
     Python 3.7 and 3.8 additionally as well as upgrading lint requirements.
     See https://github.com/peterbe/hashin/pull/118
diff --git a/hashin.py b/hashin.py
index df1a229..27ecc62 100755
--- a/hashin.py
+++ b/hashin.py
@@ -436,6 +436,8 @@ def amend_requirements_content(requirements, all_new_lines):
             for line in requirements.splitlines():
                 if regex.search(line):
                     lines.append(line)
+                elif lines and line.startswith(indent + padding + "#"):
+                    break
                 elif lines and line.startswith(indent + padding):
                     lines.append(line)
                 elif lines:

problem_statement: hashin removes # when hashes were generated with pip-compile
Looks like `hashin` removes `#` when hashes were generated with `pip-compile` originally. Example 

```
-requests==2.25.1 \
-    --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804 \
-    --hash=sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e
-    # via -r project/requirements.in
+requests==2.22.0 \
+    --hash=sha256:11e007a8a2aa0323f5a921e9e6a2d7e4e67d9877e85773fba9ba6419025cbeb4 \
+    --hash=sha256:9cf5292fcd0f598c671cfc1e0d7d1a7f13bb8085e9a590f48c010551dc6c4b31
```
repo: peterbe/hashin
test_cmd: pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
test_patch: diff --git a/tests/test_cli.py b/tests/test_cli.py
index 7f5d119..0ba7f74 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -415,6 +415,50 @@ autocompeter==1.2.3
     assert result == new_lines[2]
 
 
+def test_amend_requirements_content_replacement_keep_indented_comments():
+    requirements = (
+        """
+autocompeter==1.2.2 \\
+    --hash=sha256:33a5d0145e82326e781ddee1ad375f92cb84f8cfafea56e9504682adff64a5ee
+    # some comment created
+    #    by pip-compile
+examplepackage==10.0.0 \\
+    --hash=sha256:fd54e979d3747be638f59de44a7f6523bed56d81961a438462b1346f49be5fe4 \\
+    --hash=sha256:12ce5c2ef718e7e31cef2e2a3bde771d9216f2cb014efba963e69cb709bcbbd1
+    # another comment
+    # indicating where this package comes from
+    """.strip()
+        + "\n"
+    )
+
+    new_lines = (
+        "autocompeter",
+        "autocompeter",
+        """
+autocompeter==1.2.3 \\
+    --hash=sha256:4d64ed1b9e0e73095f5cfa87f0e97ddb4c840049e8efeb7e63b46118ba1d623a
+    """.strip()
+        + "\n",
+    )
+
+    result = hashin.amend_requirements_content(requirements, [new_lines])
+    expect = (
+        """
+autocompeter==1.2.3 \\
+    --hash=sha256:4d64ed1b9e0e73095f5cfa87f0e97ddb4c840049e8efeb7e63b46118ba1d623a
+    # some comment created
+    #    by pip-compile
+examplepackage==10.0.0 \\
+    --hash=sha256:fd54e979d3747be638f59de44a7f6523bed56d81961a438462b1346f49be5fe4 \\
+    --hash=sha256:12ce5c2ef718e7e31cef2e2a3bde771d9216f2cb014efba963e69cb709bcbbd1
+    # another comment
+    # indicating where this package comes from
+    """.strip()
+        + "\n"
+    )
+    assert result == expect
+
+
 def test_amend_requirements_content_actually_not_replacement():
     requirements = (
         """