CVE-2017-5715 marks the retpoline enablement. we currently do not need it necessarily, as the relevant packages are built with gcc which has it.