diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4daac290..93329c3a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -35,9 +35,11 @@ Build/Ubuntu:
   stage: testing
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU_BUILD
   script:
-  - git submodule update --init && autoreconf -fvi
+  - git submodule update --init
+  - autoreconf -fvi
   - ./configure --without-nuttcp-tests --without-docker-tests
-  - make -j$JOBS && make check -j$JOBS
+  - make -j$JOBS
+  - make check -j$JOBS
   tags:
   - shared
   - linux
@@ -77,8 +79,11 @@ Build/Centos7:
   stage: testing
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS7_BUILD
   script:
-  - git submodule update --init && autoreconf -fvi &&
-    ./configure --without-docker-tests && make -j$JOBS && make check -j$JOBS
+  - git submodule update --init
+  - autoreconf -fvi
+  - ./configure --without-docker-tests
+  - make -j$JOBS
+  - make check -j$JOBS
   tags:
   - shared
   - linux
@@ -91,21 +96,65 @@ Build/Centos7:
       - ./*.log
       - ./tests/*.log
 
-RPM/el7:
+RPM/epel7:
   stage: deploy
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS7_BUILD
   script:
-  - git submodule update --init && autoreconf -fvi && ./configure && touch ChangeLog && make dist
+  - git submodule update --init
+  - autoreconf -fvi
+  - ./configure
+  - touch ChangeLog
+  - make dist
   - CURDIR=$(pwd)
   - TARFILE=$(find ./ -name '*.tar.xz')
   - RPMVERSION=$(cat /usr/local/rpms/ocserv/*.spec|grep ^Version|awk '{print $2}')
   - NEWVERSION=$(echo $TARFILE|sed -e 's/ocserv-//' -e 's/\.tar\.xz//' -e 's|./||')
   - echo "tarfile $TARFILE" && echo "rpm $RPMVERSION" && echo "new $NEWVERSION"
   - cp $TARFILE /usr/local/rpms/ocserv
-  - cd /usr/local/rpms/ocserv && sed -i -e "s/$RPMVERSION/$NEWVERSION/" -e 's/have_gpgv2 1/have_gpgv2 0/g' *.spec &&
-    cat sources|grep -v "ocserv-$RPMVERSION" >sources.tmp && sha512sum --tag ocserv-$NEWVERSION.tar.xz >>sources.tmp &&
-    mv sources.tmp sources && touch ocserv-$NEWVERSION.tar.xz.sig && fedpkg --release el7 local
-  - cd $CURDIR && find /usr/local/rpms/ocserv -name '*.rpm' -exec cp '{}' ./ ';'
+  - cd /usr/local/rpms/ocserv
+  - sed -i -e "s/$RPMVERSION/$NEWVERSION/" -e 's/have_gpgv2 1/have_gpgv2 0/g' *.spec
+  - cat sources|grep -v "ocserv-$RPMVERSION" >sources.tmp
+  - sha512sum --tag ocserv-$NEWVERSION.tar.xz >>sources.tmp
+  - mv sources.tmp sources
+  - touch ocserv-$NEWVERSION.tar.xz.sig
+  - fedpkg --release el7 local
+  - cd $CURDIR
+  - find /usr/local/rpms/ocserv -name '*.rpm' -exec cp '{}' ./ ';'
+  tags:
+  - shared
+  - linux
+  except:
+   - tags
+  artifacts:
+    expire_in: 1 week
+    when: on_success
+    paths:
+     - ./*.rpm
+
+RPM/epel8:
+  stage: deploy
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
+  script:
+  - git submodule update --init
+  - autoreconf -fvi
+  - ./configure
+  - touch ChangeLog
+  - make dist
+  - CURDIR=$(pwd)
+  - TARFILE=$(find ./ -name '*.tar.xz')
+  - RPMVERSION=$(cat /usr/local/rpms/ocserv/*.spec|grep ^Version|awk '{print $2}')
+  - NEWVERSION=$(echo $TARFILE|sed -e 's/ocserv-//' -e 's/\.tar\.xz//' -e 's|./||')
+  - echo "tarfile $TARFILE" && echo "rpm $RPMVERSION" && echo "new $NEWVERSION"
+  - cp $TARFILE /usr/local/rpms/ocserv
+  - cd /usr/local/rpms/ocserv
+  - sed -i -e "s/$RPMVERSION/$NEWVERSION/" -e 's/have_gpgv2 1/have_gpgv2 0/g' *.spec
+  - cat sources|grep -v "ocserv-$RPMVERSION" >sources.tmp
+  - sha512sum --tag ocserv-$NEWVERSION.tar.xz >>sources.tmp
+  - mv sources.tmp sources
+  - touch ocserv-$NEWVERSION.tar.xz.sig
+  - fedpkg --release el8 local
+  - cd $CURDIR
+  - find /usr/local/rpms/ocserv -name '*.rpm' -exec cp '{}' ./ ';'
   tags:
   - shared
   - linux
@@ -122,12 +171,13 @@ Coverity:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
   only:
     refs:
-       - master
+       - master@openconnect/ocserv
        - coverity
   script:
   - wget https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$COVERITY_SCAN_PROJECT_NAME" -O /tmp/coverity_tool.tgz
   - tar xfz /tmp/coverity_tool.tgz
-  - git submodule update --init && autoreconf -fvi
+  - git submodule update --init
+  - autoreconf -fvi
   - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests --with-werror
   - cov-analysis-linux64-*/bin/cov-build --dir cov-int make -j$JOBS
   - tar cfz cov-int.tar.gz cov-int
@@ -153,10 +203,14 @@ Build/Fedora:
   # ensure gcov scripts are writable
   - umask 000
   - chmod -R o-w tests/data/raddb
-  - git submodule update --init && autoreconf -fvi
+  - git submodule update --init
+  - autoreconf -fvi
   - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests --with-werror --enable-code-coverage --enable-kerberos-tests
-  - make -j$JOBS && make check -j$JOBS COVERAGE=1
-  - make files-update && make dist && make local-code-coverage-output
+  - make -j$JOBS
+  - make check -j$JOBS COVERAGE=1
+  - make files-update
+  - make dist
+  - make local-code-coverage-output
   tags:
   - shared
   - linux
@@ -172,8 +226,11 @@ Build/Centos6:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS6_BUILD
   script:
   - sed -i 's/AM_PROG_AR//g' configure.ac
-  - git submodule update --init && autoreconf -fvi
-  - CFLAGS="$CFLAGS -I/usr/include/libev -I/usr/include/gnutls30" LIBGNUTLS_LIBS="-L/usr/lib64/gnutls30/ -lgnutls" PKG_CONFIG_LIBDIR="/usr/lib64/gnutls30/pkgconfig:/usr/lib64/pkgconfig" ./configure --disable-systemd --enable-local-libopts --without-docker-tests && make && make check -j$JOBS
+  - git submodule update --init
+  - autoreconf -fvi
+  - CFLAGS="$CFLAGS -I/usr/include/libev -I/usr/include/gnutls30" LIBGNUTLS_LIBS="-L/usr/lib64/gnutls30/ -lgnutls" PKG_CONFIG_LIBDIR="/usr/lib64/gnutls30/pkgconfig:/usr/lib64/pkgconfig" ./configure --disable-systemd --enable-local-libopts --without-docker-tests
+  - make -j$JOBS
+  - make check -j$JOBS
   tags:
   - shared
   - linux
@@ -190,8 +247,11 @@ Build/minimal:
   stage: testing
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS7_BUILD
   script:
-  - git submodule update --init && autoreconf -fvi &&
-    ./configure --without-docker-tests --without-libnl --without-liboath --without-pam --without-radius --without-utmp --without-libwrap --without-http-parser --without-lz4 --without-gssapi --without-pcl-lib --without-protobuf && make -j$JOBS && make check -j$JOBS XFAIL_TESTS="lz4-compression"
+  - git submodule update --init
+  - autoreconf -fvi
+  - ./configure --without-docker-tests --without-libnl --without-liboath --without-pam --without-radius --without-utmp --without-libwrap --without-http-parser --without-lz4 --without-gssapi --without-pcl-lib --without-protobuf
+  - make -j$JOBS
+  - make check -j$JOBS XFAIL_TESTS="lz4-compression"
   tags:
   - shared
   - linux
@@ -211,8 +271,11 @@ Build/minimal:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
   script:
   - chmod o-w tests/data/raddb
-  - git submodule update --init && autoreconf -fvi && CFLAGS="-fsanitize=address -g -O2" LDFLAGS="-static-libasan"
-    ./configure --without-pam --without-docker-tests && make -j$JOBS && make check -j$JOBS VERBOSE=1
+  - git submodule update --init
+  - autoreconf -fvi
+  - CFLAGS="-fsanitize=address -g -O2" LDFLAGS="-static-libasan" ./configure --without-pam --without-docker-tests
+  - make -j$JOBS
+  - make check -j$JOBS VERBOSE=1
   tags:
   - shared
   - linux
@@ -230,8 +293,11 @@ ubsan/Fedora:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
   script:
   - chmod -R o-w tests/data/raddb
-  - git submodule update --init && autoreconf -fvi && CFLAGS="-fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2"
-    ./configure --without-docker-tests && make -j$JOBS && make check -j$JOBS
+  - git submodule update --init
+  - autoreconf -fvi
+  - CFLAGS="-fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2" ./configure --without-docker-tests
+  - make -j$JOBS
+  - make check -j$JOBS
   tags:
   - shared
   - linux
@@ -266,9 +332,13 @@ static-analyzers/Fedora:
 Build/FreeBSD:
   stage: testing
   script:
-  - git submodule update --init && sh autogen.sh && mkdir build
-  - cd build && LIBS="-L/usr/local/lib" ../configure --disable-nls --without-root-tests &&
-    gmake -j$JOBS && gmake check -j$JOBS
+  - git submodule update --init
+  - sh autogen.sh
+  - mkdir build
+  - cd build
+  - LIBS="-L/usr/local/lib" ../configure --disable-nls --without-root-tests
+  - gmake -j$JOBS
+  - gmake check -j$JOBS
   tags:
   - freebsd
   only:
@@ -286,15 +356,16 @@ pages:
   stage: deploy
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
   script:
-  - mkdir -p public/coverage && make V=1 CODE_COVERAGE_OUTPUT_DIRECTORY=public/coverage CODE_COVERAGE_BRANCH_COVERAGE=1 code-coverage-capture &&
-    make CODE_COVERAGE_OUTPUT_DIRECTORY=public/coverage local-code-coverage-output
+  - mkdir -p public/coverage
+  - make V=1 CODE_COVERAGE_OUTPUT_DIRECTORY=public/coverage CODE_COVERAGE_BRANCH_COVERAGE=1 code-coverage-capture
+  - make CODE_COVERAGE_OUTPUT_DIRECTORY=public/coverage local-code-coverage-output
   tags:
   - shared
   - linux
   dependencies:
   - Build/Fedora
   only:
-  - master
+  - master@openconnect/ocserv
   artifacts:
     paths:
     - public