anchor.diff:    util-linux, dmidecode, libuuid, newt,
     lua, speex, libopus, opusfile, libogg,
     srtp, wget, curl, iksemel, pkg-config,
  -  autoconf, libtool, automake,
  +  autoconf, libtool, automake, fetchpatch,
     python39, writeScript,
     withOpus ? true,
   }:
   
   let
  +  # remove when upgrading to pjsip >1.12.1
  +  pjsip_patches = [
  +    (fetchpatch {
  +      name = "0150-CVE-2022-31031.patch";
  +      url = "https://github.com/pjsip/pjproject/commit/450baca94f475345542c6953832650c390889202.patch";
  +      sha256 = "sha256-30kHrmB51UIw4x/J6/CD+vPKf/gBYDCcFoUpwEWkDMY=";
  +    })
  +    (fetchpatch {
  +      name = "0151-CVE-2022-39244.patch";
  +      url = "https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae.patch";
  +      sha256 = "sha256-hTUMh6bYAizn6GF+sRV1vjKVxSf9pnI+eQdPOqsdJI4=";
  +    })
  +    (fetchpatch {
  +      name = "0152-CVE-2022-39269.patch";
  +      url = "https://github.com/pjsip/pjproject/commit/d2acb9af4e27b5ba75d658690406cec9c274c5cc.patch";
  +      sha256 = "sha256-bKE/MrRAqN1FqD2ubhxIOOf5MgvZluHHeVXPjbR12iQ=";
  +    })
  +  ];
     common = {version, sha256, externals}: stdenv.mkDerivation {
       inherit version;
       pname = "asterisk";
  
positive.code:       license = licenses.gpl2Only;
        maintainers = with maintainers; [ auntie DerTim1 yorickvp ];
      };
    };
  
    pjproject_2_12 = fetchurl {
      url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.12/pjproject-2.12.tar.bz2";
      hash = "sha256-T3q4r/4WCAZCNGnULxMnNKH9wEK7gkseV/sV8IPasHQ=";
    };
  
    pjproject_2_12_1 = fetchurl {
  
negative.code:         cp ${asterisk-opus}/codecs/* ./codecs
          cp ${asterisk-opus}/formats/* ./formats
        ''}
        ${lib.concatMapStringsSep "\n" (patch: ''
          cp ${patch} ./third-party/pjproject/patches/${patch.name}
        '') pjsip_patches}
        ./bootstrap.sh
      '';
  
  