diff --git a/.gitignore b/.gitignore
index e66e44f..2e87fad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -213,3 +213,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.12.6.tar.asc
 /samba-4.12.7.tar.xz
 /samba-4.12.7.tar.asc
+/samba-4.12.8.tar.xz
+/samba-4.12.8.tar.asc
diff --git a/samba-winexe-build.patch b/samba-winexe-build.patch
new file mode 100644
index 0000000..63f8a9e
--- /dev/null
+++ b/samba-winexe-build.patch
@@ -0,0 +1,67 @@
+From 54c21a99e6ca54bdb963c70d322f6778b57a384f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
+Date: Wed, 4 Mar 2020 18:51:01 +0100
+Subject: [PATCH] winexe: add configure option to control whether to build it
+ (default: auto)
+
+Guenther
+
+Signed-off-by: Guenther Deschner <gd@samba.org>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
+Autobuild-Date(master): Mon Mar  9 16:27:21 UTC 2020 on sn-devel-184
+---
+ examples/winexe/wscript_build |  3 ++-
+ source3/wscript               | 17 +++++++++++++++++
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/examples/winexe/wscript_build b/examples/winexe/wscript_build
+index 43c09717e3d..559ed3fc706 100644
+--- a/examples/winexe/wscript_build
++++ b/examples/winexe/wscript_build
+@@ -106,4 +106,5 @@ if winexesvc_binaries != '':
+                           LOADPARM_CTX
+                           libsmb
+                           msrpc3
+-                      ''')
++                      ''',
++                      enabled=bld.env.build_winexe)
+diff --git a/source3/wscript b/source3/wscript
+index 85466b493fa..6d5bd22ca49 100644
+--- a/source3/wscript
++++ b/source3/wscript
+@@ -63,6 +63,7 @@ def options(opt):
+     opt.samba_add_onoff_option('cluster-support', default=False)
+ 
+     opt.samba_add_onoff_option('regedit', default=None)
++    opt.samba_add_onoff_option('winexe', default=None)
+ 
+     opt.samba_add_onoff_option('fake-kaserver',
+                           help=("Include AFS fake-kaserver support"), default=False)
+@@ -1782,6 +1783,22 @@ main() {
+     if conf.CHECK_HEADERS('ftw.h') and conf.CHECK_FUNCS('nftw'):
+         conf.env.build_mvxattr = True
+ 
++    conf.env.build_winexe = False
++    if not Options.options.with_winexe == False:
++        if conf.CONFIG_SET('HAVE_WINEXE_CC_WIN32') or conf.CONFIG_SET('HAVE_WINEXE_CC_WIN64'):
++            conf.env.build_winexe = True
++
++    if conf.env.build_winexe:
++        Logs.info("building winexe")
++    else:
++        if Options.options.with_winexe == False:
++            Logs.info("not building winexe (--without-winexe)")
++        elif Options.options.with_winexe == True:
++            Logs.error("mingw not available, cannot build winexe")
++            conf.fatal("mingw not available, but --with-winexe was specified")
++        else:
++            Logs.info("mingw not available, not building winexe")
++
+     conf.CHECK_FUNCS_IN('DES_pcbc_encrypt', 'crypto')
+     if Options.options.with_fake_kaserver == True:
+         conf.CHECK_HEADERS('afs/param.h afs/stds.h', together=True)
+-- 
+2.26.2
+
diff --git a/samba.spec b/samba.spec
index a72a20f..ca0d48b 100644
--- a/samba.spec
+++ b/samba.spec
@@ -10,7 +10,7 @@
 
 %define main_release 0
 
-%define samba_version 4.12.7
+%define samba_version 4.12.8
 %define talloc_version 2.3.1
 %define tdb_version 1.4.3
 %define tevent_version 0.10.2
@@ -129,6 +129,8 @@ Source14:       samba.pamd
 
 Source201:      README.downgrade
 
+Patch:          samba-winexe-build.patch
+
 Requires(pre): /usr/sbin/groupadd
 Requires(post): systemd
 Requires(preun): systemd
@@ -3581,9 +3583,13 @@ fi
 ### WINEXE
 %files winexe
 %{_bindir}/winexe
+%{_mandir}/man1/winexe.1*
 %endif
 
 %changelog
+* Wed Oct 07 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.8-0
+- Update to Samba 4.12.8
+
 * Fri Sep 18 2020 Guenther Deschner <gdeschner@redhat.com> - 4.12.7-0
 - Update to Samba 4.12.7
 - resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472
diff --git a/sources b/sources
index 8f5ff94..24ded22 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.12.7.tar.xz) = 2d16ebec869cfc74e40342487634d3855b507852308efef1cf1db4ee838153c7756efc39f0f02142c1a624e8002a8a7e5de223ccd2045cd720c0fe0ce664881b
-SHA512 (samba-4.12.7.tar.asc) = e82d890004f74fb93dd06c84cd28d7e69e47f065b46057a878bab2f17edb0f5f65ebfebf931692468cfa6cf8b904449932601ef597367d8c6a4f67c18ee99053
+SHA512 (samba-4.12.8.tar.xz) = 8d4ed3f0daf5859766e48fed9ebf1c1fca5c8894aa28ca70a3163bf3e946a83f9413faea562f6bea751a90eecd0717afdf61266d9f1dd38d5e6d8c628d34fd59
+SHA512 (samba-4.12.8.tar.asc) = 771aca96be911869b8d383d4e16957b2e5f95bba1aa6cd4092f581cf68cf145a6c85ecfe4a47e4d27c0ac1f8e3175c3dfbc25d669fd2fe699dc4420cf617539f