diff --git a/.appveyor.yml b/.appveyor.yml
index 392d3310..154ee438 100644
--- a/.appveyor.yml
+++ b/.appveyor.yml
@@ -23,7 +23,7 @@ environment:
 
 init:
   - git config --global core.autocrlf input
-  - where bash & where cat & where cp & where curl & where date & where file & where git & where gzip & where mkdir & where mv & where openssl & where readlink & where rm & where rmdir & where sed & where sha256sum & where ssh & where ssh-add & where ssh-agent & where tar
+  - where bash & where cat & where chmod & where cp & where curl & where date & where file & where git & where gzip & where mkdir & where mv & where openssl & where readlink & where rm & where rmdir & where sed & where sha256sum & where sort & where ssh & where ssh-add & where ssh-agent & where ssh-keyscan & where tar
 # - bash --version & git --version & sed --version & tar --version
   - git --version & bash --version
 # - dir "c:\Program Files\Git\usr\bin"
diff --git a/.github/travis_deploy.sh b/.github/travis_deploy.sh
index 5b043863..fda63132 100644
--- a/.github/travis_deploy.sh
+++ b/.github/travis_deploy.sh
@@ -25,6 +25,8 @@ if [[ $BM_B =~ (^|\+)valgrind($|\+) ]]; then exit 0; fi
 if [[ -n $APPVEYOR_JOB_ID ]]; then
     TRAVIS_BRANCH=$APPVEYOR_REPO_BRANCH
     if [[ -n $APPVEYOR_PULL_REQUEST_NUMBER ]]; then exit 0; fi
+elif [[ -n $GITLAB_CI ]]; then
+    TRAVIS_BRANCH=$CI_BUILD_REF_NAME
 else
     if [[ "$TRAVIS_PULL_REQUEST" != "false" ]]; then exit 0; fi
 fi
@@ -32,7 +34,7 @@ if [[ "$TRAVIS_BRANCH" != "devel" ]]; then
     exit 0
 fi
 
-# get $rev and $branch
+# get $rev, $branch and $git_user
 cd / && cd $upx_SRCDIR || exit 1
 rev=$(git rev-parse --verify HEAD)
 timestamp=$(git log -n1 --format='%at' HEAD)
@@ -40,8 +42,13 @@ date=$(TZ=UTC0 date -d "@$timestamp" '+%Y%m%d-%H%M%S')
 branch="$TRAVIS_BRANCH-$date-${rev:0:6}"
 if [[ -n $APPVEYOR_JOB_ID ]]; then
     branch="$branch-appveyor"
+    git_user="AppVeyor CI"
+elif [[ -n $GITLAB_CI ]]; then
+    branch="$branch-gitlab"
+    git_user="GitLab CI"
 else
     branch="$branch-travis"
+    git_user="Travis CI"
 fi
 unset timestamp date
 
@@ -52,6 +59,7 @@ unset timestamp date
 cd / && cd $upx_BUILDDIR || exit 1
 
 mkdir deploy || exit 1
+chmod 700 deploy
 cd deploy || exit 1
 
 if [[ -n $BM_CROSS ]]; then
@@ -79,8 +87,8 @@ mkdir $d || exit 1
 for exeext in .exe .out; do
     f=$upx_BUILDDIR/upx$exeext
     if [[ -f $f ]]; then
-        cp -p -i $f $d/upx-${rev:0:12}$exeext
-        sha256sum -b $d/upx-${rev:0:12}$exeext
+        cp -p -i $f  $d/upx-git-${rev:0:12}$exeext
+        sha256sum -b $d/upx-git-${rev:0:12}$exeext
     fi
 done
 
@@ -94,9 +102,8 @@ if ! git clone -b $branch --single-branch https://github.com/upx/upx-automatic-b
     new_branch=1
 fi
 cd upx-automatic-builds || exit 1
-if [[ -n $APPVEYOR_JOB_ID ]]; then git config user.name "AppVeyor CI"
-else git config user.name "Travis CI"
-fi
+chmod 700 .git
+git config user.name "$git_user"
 git config user.email "none@none"
 if [[ $new_branch == 1 ]]; then
     git checkout --orphan $branch
@@ -117,6 +124,8 @@ git commit --date="$now" -m "Automatic build $d"
 git ls-files
 #git log --pretty=fuller
 
+umask 077
+[[ -d ~/.ssh ]] || mkdir ~/.ssh
 repo=$(git config remote.origin.url)
 ssh_repo=${repo/https:\/\/github.com\//git@github.com:}
 eval $(ssh-agent -s)
@@ -125,6 +134,7 @@ openssl aes-256-cbc -d -a -K "$UPX_AUTOMATIC_BUILDS_SSL_KEY" -iv "$UPX_AUTOMATIC
 set -x
 chmod 600 .git/deploy.key
 ssh-add .git/deploy.key
+ssh-keyscan -H github.com >> ~/.ssh/known_hosts
 
 let i=0 || true
 while [[ $i -lt 10 ]]; do
@@ -134,7 +144,6 @@ while [[ $i -lt 10 ]]; do
         if git push    $ssh_repo $branch; then break; fi
     fi
     git fetch origin $branch
-    new_branch=0
     git rebase origin/$branch $branch
     sleep $((RANDOM % 5 + 1))
     let i=i+1
diff --git a/.github/travis_init.sh b/.github/travis_init.sh
index fe50ffe3..16f8e933 100644
--- a/.github/travis_init.sh
+++ b/.github/travis_init.sh
@@ -19,6 +19,8 @@ unset CROSS C B T X
 
 # just in case, unset variable for passing extra UPX options
 export UPX=
+# un-export some vars
+declare +x UPX_AUTOMATIC_BUILDS_SSL_KEY UPX_AUTOMATIC_BUILDS_SSL_IV
 
 # compatibility wrappers
 if [[ $TRAVIS_OS_NAME == osx ]]; then
@@ -37,7 +39,6 @@ if [[ -n $APPVEYOR_JOB_ID ]]; then
 openssl() {
     /usr/bin/openssl "$@"
 }
-# for some reason this is needed for bash on AppVeyor
 sort() {
     /usr/bin/sort "$@"
 }
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 6417428a..6916aec9 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,7 +4,7 @@
 before_script:
   - export TRAVIS_OS_NAME=linux
   - unset CROSS C B T X
-  - uname -a; pwd; id; umask; env
+  - uname -a; pwd; id; umask
   - cat /etc/os-release || true
   -
     if [[ $CI_BUILD_NAME =~ ^(CentOS|Fedora) ]]; then
@@ -24,7 +24,7 @@ before_script:
       time rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm;
       time yum install -y
         coreutils curl diffutils grep gzip sed
-        bzip2 file findutils git perl tar wget which xz
+        bzip2 file findutils git openssh-clients openssl perl tar wget which xz
         gcc gcc-c++ make valgrind
         glibc-devel      libstdc++-devel      zlib-devel
         glibc-devel.i386 libstdc++-devel.i386 zlib-devel.i386;
@@ -33,7 +33,7 @@ before_script:
     if [[ $CI_BUILD_NAME =~ ^CentOS6- ]]; then
       time yum install -y
         coreutils curl diffutils grep gzip sed
-        bzip2 file findutils git perl tar wget which xz
+        bzip2 file findutils git openssh-clients openssl perl tar wget which xz
         gcc gcc-c++ make valgrind
         glibc-devel      libstdc++-devel      zlib-devel
         glibc-devel.i686 libstdc++-devel.i686 zlib-devel.i686;
@@ -42,7 +42,7 @@ before_script:
     if [[ $CI_BUILD_NAME =~ ^CentOS7- ]]; then
       time yum install -y
         coreutils curl diffutils grep gzip sed
-        bzip2 file findutils git perl tar wget which xz
+        bzip2 file findutils git openssh-clients openssl perl tar wget which xz
         clang gcc gcc-c++ make valgrind
         glibc-devel      libasan      libstdc++-devel      zlib-devel
         glibc-devel.i686 libasan.i686 libstdc++-devel.i686 zlib-devel.i686;
@@ -51,7 +51,7 @@ before_script:
     if [[ $CI_BUILD_NAME =~ ^Fedora ]]; then
       time dnf install -y --best --allowerasing
         coreutils curl diffutils grep gzip sed
-        bzip2 file findutils git perl tar wget which xz
+        bzip2 file findutils git openssh-clients openssl perl tar wget which xz
         clang gcc gcc-c++ lcov make valgrind
         glibc-devel      libasan      libstdc++-devel      libubsan      zlib-devel
         glibc-devel.i686 libasan.i686 libstdc++-devel.i686 libubsan.i686 zlib-devel.i686;
@@ -60,7 +60,7 @@ before_script:
     if [[ $CI_BUILD_NAME =~ ^(Debian|Ubuntu) ]]; then
       time apt-get -yq --no-install-suggests --no-install-recommends --force-yes upgrade;
       time apt-get -yq --no-install-suggests --no-install-recommends --force-yes install
-        build-essential ca-certificates curl file git wget xz-utils zlib1g-dev;
+        build-essential ca-certificates curl file git openssh-client openssl wget xz-utils zlib1g-dev;
     fi
   -
     if [[ $CI_BUILD_NAME =~ ^Ubuntu1604-cross ]]; then
@@ -126,16 +126,17 @@ CentOS7-clang+gcc-m32+64: # clang-3.4, gcc-4.8
 Debian7-gcc-m64: # gcc-4.7
   image: debian:7
   script:
-  - time C=gcc-m64              bash ./.github/travis_build.sh
-  - time C=gcc-m64              bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-4.7-m64          bash ./.github/travis_build.sh
+  - time C=gcc-4.7-m64          bash ./.github/travis_testsuite_1.sh
   tags: [ shared ]
   except: [ tags ]
 
 Debian8-gcc-m64: # gcc-4.9
   image: debian:8
   script:
-  - time C=gcc-m64              bash ./.github/travis_build.sh
-  - time C=gcc-m64              bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-4.9-m64          bash ./.github/travis_build.sh
+  - time C=gcc-4.9-m64          bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-4.9-m64          bash ./.github/travis_deploy.sh
   tags: [ shared ]
   except: [ tags ]
 
@@ -196,24 +197,26 @@ Fedora25-clang+gcc-m32+m64: # clang-3.8, gcc-6
 Ubuntu1204-gcc-m64: # gcc-4.6
   image: ubuntu:12.04
   script:
-  - time C=gcc-m64              bash ./.github/travis_build.sh
-  - time C=gcc-m64              bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-4.6-m64          bash ./.github/travis_build.sh
+  - time C=gcc-4.6-m64          bash ./.github/travis_testsuite_1.sh
   tags: [ shared ]
   except: [ tags ]
 
 Ubuntu1404-gcc-m64: # gcc-4.8
   image: ubuntu:14.04
   script:
-  - time C=gcc-m64              bash ./.github/travis_build.sh
-  - time C=gcc-m64              bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-4.8-m64          bash ./.github/travis_build.sh
+  - time C=gcc-4.8-m64          bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-4.8-m64          bash ./.github/travis_deploy.sh
   tags: [ shared ]
   except: [ tags ]
 
 Ubuntu1604-gcc-m64: # gcc-5
   image: ubuntu:16.04
   script:
-  - time C=gcc-m64              bash ./.github/travis_build.sh
-  - time C=gcc-m64              bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-5-m64            bash ./.github/travis_build.sh
+  - time C=gcc-5-m64            bash ./.github/travis_testsuite_1.sh
+  - time C=gcc-5-m64            bash ./.github/travis_deploy.sh
   tags: [ shared ]
   except: [ tags ]
 
@@ -242,6 +245,17 @@ Ubuntu1604-cross:
 # - time CROSS=powerpc64le-linux-gnu C=gcc-5 T=qemu bash ./.github/travis_testsuite_1.sh
 # - time CROSS=s390x-linux-gnu       C=gcc-5 T=qemu bash ./.github/travis_testsuite_1.sh
 # - time CROSS=x86_64-w64-mingw32    C=gcc-5 T=wine bash ./.github/travis_testsuite_1.sh
+  - time CROSS=aarch64-linux-gnu     C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=arm-linux-gnueabi     C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=arm-linux-gnueabihf   C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=i686-w64-mingw32      C=gcc-5 T=wine bash ./.github/travis_deploy.sh
+  - time CROSS=mips-linux-gnu        C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=mipsel-linux-gnu      C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=powerpc-linux-gnu     C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=powerpc64-linux-gnu   C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=powerpc64le-linux-gnu C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=s390x-linux-gnu       C=gcc-5 T=qemu bash ./.github/travis_deploy.sh
+  - time CROSS=x86_64-w64-mingw32    C=gcc-5 T=wine bash ./.github/travis_deploy.sh
   tags: [ shared ]
   except: [ tags ]