why not just add a sysctl file that gets installed with kernel-obs-build and be done? and i dont see why disabling spectre things in the build time kernel should be done.