diff --git a/calico-3.28.yaml b/calico-3.28.yaml
deleted file mode 100644
index 89e7e91a5bc..00000000000
--- a/calico-3.28.yaml
+++ /dev/null
@@ -1,580 +0,0 @@
-package:
-  name: calico-3.28
-  version: 3.28.2
-  epoch: 1
-  description: "Cloud native networking and network security"
-  copyright:
-    - license: Apache-2.0
-  dependencies:
-    provides:
-      - calico=${{package.full-version}}
-  resources:
-    cpu: 4
-    memory: 12Gi
-  checks:
-    disabled:
-      - empty
-
-var-transforms:
-  - from: ${{package.version}}
-    match: ^(\d+\.\d+)\.\d+$
-    replace: "$1"
-    to: short-package-version
-
-environment:
-  contents:
-    packages:
-      - autoconf
-      - automake
-      - bash
-      - bison
-      - build-base
-      - busybox
-      - ca-certificates-bundle
-      # - llvm16-tools
-      - clang-16
-      - clang-16-dev
-      # TODO: Can remove this when cni-plugins are built from source
-      - curl
-      # for felix
-      - elfutils-dev
-      # for BIRD
-      - flex
-      - go
-      - iproute2
-      - libbpf
-      - libbpf-dev
-      - libpcap-dev
-      - linux-headers
-      - llvm16
-      - openssf-compiler-options
-      - zlib-dev
-      - zstd-dev
-
-# The calico build process is heavily tailored towards using Makefiles to
-# orchestrate docker commands. This makes for a less than ideal
-# experience replicating it in melange. To try to maintain some level of
-# sanity while packaging and updating calico, the approach here chooses to
-# use the upstream Makefile whenever possible, and only when necessary,
-# use the equivalent evaluated `docker run ...` commands within
-# independent pipeline blocks. Throughout this file you'll see the relevant
-# comments denoting the equivalent Makefile targets that each pipeline
-# block is trying to match, if applicable.
-pipeline:
-  - uses: git-checkout
-    with:
-      repository: https://github.com/projectcalico/calico
-      tag: v${{package.version}}
-      expected-commit: 9a96ee39f3833c3eabde151add8a84d546bcf24d
-  - working-directory: felix
-    pipeline:
-      # Equivalent to target: "build-bpf"
-      - runs: |
-          # NOTE: This forces 64bit compilation (and the __x86_64__ macro) to bypasses the following error:
-          #   /usr/include/gnu/stubs.h:7:11: fatal error: 'gnu/stubs-32.h' file not found
-          # This is a hack, but feels safe enough given we already assume and restrict this package to 64bit archs
-          # NOTE: This disables Wolfi's default host level CFLAGS since this is BPF bytecode, instead, we pick up the defaults specified in the Makefiles
-          export CFLAGS="-Wno-error=unused-but-set-variable -D__x86_64__"
-
-          if [ "${{build.arch}}" = "x86_64" ]; then
-            export CFLAGS="-Wno-error=unused-but-set-variable -m64 -D__x86_64__"
-          fi
-          make -C bpf-gpl CC=clang LD=llc -j$(nproc)
-          make -C bpf-apache CC=clang LD=llc -j$(nproc)
-      # Equivalent to target: "libbpf"
-      - runs: |
-          _arch=${{build.goarch}}
-          mkdir -p bpf-gpl/include/libbpf/src/${{build.goarch}}
-
-          # NOTE: This disables Wolfi's default host level CFLAGS since this is BPF bytecode, instead, we pick up the defaults specified in the Makefiles
-
-          export CFLAGS="-Wno-error=sign-compare"
-          if [ "${{build.arch}}" = "x86_64" ]; then
-            export CFLAGS="-Wno-error=sign-compare -m64"
-          fi
-
-          make -C bpf-gpl/include/libbpf/src BUILD_STATIC_ONLY=2 OBJDIR=$_arch -j$(nproc)
-  # This fetches and builds the statically compiled calico fork of BIRD
-  - working-directory: bird
-    pipeline:
-      - uses: fetch
-        with:
-          # Reference: https://github.com/projectcalico/calico/blob/master/metadata.mk#L26
-          # TODO: Build this from source and load in as a package runtime dependency
-          uri: https://github.com/projectcalico/bird/tarball/v0.3.3-202-g7a77fb73
-          expected-sha512: 87d03464163459154dce11952025f4a0de316dbfe0d1f6a3f19a82e951dfca2eb5d0cd18d95eda3abd38d44a9967fbb4b017158d8a5f48951683e3dc87dcd914
-      - runs: |
-          ARCH=${{build.arch}} DIST=dist/ ./create_binaries.sh
-  - working-directory: node
-    pipeline:
-      # Equivalent to target: "filesystem/etc/calico/confd/conf.d"
-      - runs: |
-          _target="filesystem/etc/calico/confd/conf.d"
-          rm -rf $_target && cp -r ../confd/etc/calico/confd/conf.d $_target
-          chmod +w $_target
-      # Equivalent to target: "filesystem/etc/calico/confd/templates"
-      - runs: |
-          _target="filesystem/etc/calico/confd/templates"
-          rm -rf $_target && cp -r ../confd/etc/calico/confd/templates $_target
-          chmod +w $_target
-      # Equivalent to target: "filesystem/usr/lib/calico/bpf"
-      - runs: |
-          _target="filesystem/usr/lib/calico/bpf"
-          rm -rf $_target && mkdir -p $_target
-
-          # This is handled in the felix build pipeline above
-          # make -C ../felix build-bpf ARCH=$(ARCH)
-          cp -r ../felix/bpf-gpl/bin/* $_target
-          cp -r ../felix/bpf-apache/bin/* $_target
-  - uses: strip
-
-subpackages:
-  - name: "calico-node-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-node=${{package.full-version}}
-      runtime:
-        - runit
-        - bash # required for logging functionality to work since `start_runit` logging script uses #!/bin/bash
-        - iptables
-        - ip6tables
-        - ipset
-        - libpcap
-        - libelf
-        - zlib
-        - libbpf
-        # listed in Dockerfile, but not sure if they're build dependencies (for iptables) or runtime
-        - libmnl
-        - libnfnetlink
-        - libnetfilter_conntrack
-        - iproute2
-        - procps
-        - conntrack-tools
-        - libnetfilter_cthelper
-        - libnetfilter_cttimeout
-        - libnetfilter_queue
-        - glibc
-    pipeline:
-      - assertions:
-          required-steps: 2
-        pipeline:
-          # Equivalent to target: "$(NODE_CONTAINER_BINARY)"
-          - if: ${{build.arch}} == 'x86_64' || ${{build.arch}} == 'aarch64' # Essentially a guard to make sure we never try to build beyond x86_64 and aarch64
-            runs: |
-              _arch=${{build.goarch}}
-
-              LIBBPF_CONTAINER_PATH=/home/build/felix/bpf-gpl/include/libbpf/src
-              BPFGPL_CONTAINER_PATH=/home/build/felix/bpf-gpl
-
-              CGO_LDFLAGS="-L$LIBBPF_CONTAINER_PATH/$_arch -lbpf -lelf -lz"
-              CGO_CFLAGS="-I$LIBBPF_CONTAINER_PATH -I$BPFGPL_CONTAINER_PATH"
-
-              LDFLAGS="-w"
-              LDFLAGS="$LDFLAGS -X node/pkg/lifecycle/startup.VERSION=${{package.version}}"
-              LDFLAGS="$LDFLAGS -X node/buildinfo.GitVersion=$(git describe --tags --dirty --always --abbrev=12 || echo '<unknown>')"
-              LDFLAGS="$LDFLAGS -X node/buildinfo.BuildDate=$(date -u +'%FT%T%z')"
-              LDFLAGS="$LDFLAGS -X node/buildinfo.GitRevision=$(git rev-parse HEAD || echo '<unknown>')"
-
-              # Mitigate CVE-2023-48795
-              go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.17.0
-
-              go mod tidy
-
-              CGO_ENABLED=1 \
-                CGO_LDFLAGS="$CGO_LDFLAGS" \
-                CGO_CFLAGS="$CGO_CFLAGS" \
-                go build -v -tags cgo -v -buildvcs=false \
-                -ldflags "$LDFLAGS" \
-                -o "${{targets.subpkgdir}}"/bin/calico-node \
-                ./node/cmd/calico-node
-          # Equivalent to target: "$(TOOLS_MOUNTNS_BINARY)"
-          - runs: |
-              _arch=${{build.goarch}}
-
-              LIBBPF_CONTAINER_PATH=/home/build/felix/bpf-gpl/include/libbpf/src
-              BPFGPL_CONTAINER_PATH=/home/build/felix/bpf-gpl
-
-              CGO_LDFLAGS="-L$LIBBPF_CONTAINER_PATH/$_arch -lbpf -lelf -lz"
-              CGO_CFLAGS="-I$LIBBPF_CONTAINER_PATH -I$BPFGPL_CONTAINER_PATH"
-              CGO_ENABLED=1 \
-                CGO_LDFLAGS="$CGO_LDFLAGS" \
-                CGO_CFLAGS="$CGO_CFLAGS" \
-                go build -v -tags cgo -v -buildvcs=false \
-                -o "${{targets.subpkgdir}}"/bin/mountns \
-                ./node/cmd/mountns
-      # Equivalent to target: "$(FELIX_GPL_SOURCE)"
-      - working-directory: node
-        runs: |
-          _target="filesystem/included-source/felix-ebpf-gpl.tar.gz"
-
-          rm -rf filesystem/included-source/felix*
-          mkdir -p filesystem/included-source/
-
-          tar cf $_target ../felix/bpf-gpl
-          touch $_target
-      # Filesystem prep
-      - runs: |
-          # BIRD needs to run with root permissions, so put them in /bin/ to remember
-          mkdir -p "${{targets.subpkgdir}}"/bin
-          find bird/dist -type f -name 'bird*' -exec cp {} "${{targets.subpkgdir}}"/bin \;
-
-          mkdir -p "${{targets.subpkgdir}}"/etc \
-                   "${{targets.subpkgdir}}"/included-source \
-                   "${{targets.subpkgdir}}"/licenses \
-                   "${{targets.subpkgdir}}"/usr/sbin
-
-          cp -avR ./node/filesystem/etc "${{targets.subpkgdir}}"/
-          cp -avR ./node/filesystem/included-source "${{targets.subpkgdir}}"/
-          cp -avR ./node/filesystem/usr "${{targets.subpkgdir}}"/
-          cp -avR ./node/filesystem/sbin/* "${{targets.subpkgdir}}"/usr/sbin/
-          cp ./node/LICENSE "${{targets.subpkgdir}}"/licenses/
-
-          # TODO: Proper fix for this
-          rm -f "${{targets.subpkgdir}}"/etc/nsswitch.conf
-
-  # The felix binaries aren't actually shipped, but they contain some useful testing utilities
-  - name: "calico-felix-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-felix=${{package.full-version}}
-      runtime:
-        - iproute2
-        - libelf
-        - zlib
-        - libbpf
-        - glibc
-    pipeline:
-      - working-directory: felix
-      - runs: |
-          _arch=${{build.goarch}}
-
-          LIBBPF_CONTAINER_PATH=$(pwd)/felix/bpf-gpl/include/libbpf/src
-          BPFGPL_CONTAINER_PATH=$(pwd)/felix/bpf-gpl
-
-          CGO_LDFLAGS="-L$LIBBPF_CONTAINER_PATH/$_arch -lbpf -lelf -lz"
-          CGO_CFLAGS="-I$LIBBPF_CONTAINER_PATH -I$BPFGPL_CONTAINER_PATH"
-
-          LDFLAGS="-w"
-          LDFLAGS="$LDFLAGS -X node/buildinfo.GitVersion=$(git describe --tags --dirty --always --abbrev=12 || echo '<unknown>')"
-          LDFLAGS="$LDFLAGS -X node/buildinfo.BuildDate=$(date -u +'%FT%T%z')"
-          LDFLAGS="$LDFLAGS -X node/buildinfo.GitRevision=$(git rev-parse HEAD || echo '<unknown>')"
-          LDFLAGS="$LDFLAGS -B 0x$(git rev-parse HEAD || uuidgen | sed 's/-//g')"
-
-          CGO_ENABLED=1 \
-            CGO_LDFLAGS="$CGO_LDFLAGS" \
-            CGO_CFLAGS="$CGO_CFLAGS" \
-            go build -v -tags cgo -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -o "${{targets.subpkgdir}}"/usr/bin/felix \
-            ./felix/cmd/calico-felix
-
-          CGO_ENABLED=1 \
-            CGO_LDFLAGS="$CGO_LDFLAGS" \
-            CGO_CFLAGS="$CGO_CFLAGS" \
-            go build -v -tags cgo -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -o "${{targets.subpkgdir}}"/usr/bin/calico-bpf \
-            ./felix/cmd/calico-bpf
-
-          CGO_ENABLED=1 \
-            CGO_LDFLAGS="$CGO_LDFLAGS" \
-            CGO_CFLAGS="$CGO_CFLAGS" \
-            go build -v -tags cgo -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -o "${{targets.subpkgdir}}"/usr/bin/pktgen \
-            ./felix/fv/pktgen
-
-          CGO_ENABLED=1 \
-            CGO_LDFLAGS="$CGO_LDFLAGS" \
-            CGO_CFLAGS="$CGO_CFLAGS" \
-            go build -v -tags cgo -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -o "${{targets.subpkgdir}}"/usr/bin/iptables-locker \
-            ./felix/fv/iptables-locker
-
-          CGO_ENABLED=1 \
-            CGO_LDFLAGS="$CGO_LDFLAGS" \
-            CGO_CFLAGS="$CGO_CFLAGS" \
-            go build -v -tags cgo -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -o "${{targets.subpkgdir}}"/usr/bin/test-connection \
-            ./felix/fv/test-connection
-
-          CGO_ENABLED=1 \
-            CGO_LDFLAGS="$CGO_LDFLAGS" \
-            CGO_CFLAGS="$CGO_CFLAGS" \
-            go build -v -tags cgo -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -o "${{targets.subpkgdir}}"/usr/bin/test-workload \
-            ./felix/fv/test-workload
-
-  - name: "calico-cni-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-cni=${{package.full-version}}
-      runtime:
-        - flannel-cni-plugin
-        - cni-plugins-loopback
-        - cni-plugins-host-local
-        - cni-plugins-portmap
-        - cni-plugins-tuning
-        - cni-plugins-bandwidth
-    pipeline:
-      # NOTE: cni is a multicall binary: https://github.com/projectcalico/calico/blob/master/cni-plugin/cmd/calico/calico.go
-      # install is not a part of that multicall binary anymore (as of calico 3.27.1)
-      - runs: |
-          # On boot (of calico-node) the CNI is installed/copied onto the host
-          # node and run when pod network sandboxes are created. Since it runs on
-          # the host, we explicitly statically compile this to ensure it doesn't
-          # conflict with the hosts GLIBC, which is often a much more outdated
-          # version than what we build with.
-          LDFLAGS="-w -X main.VERSION=$(git describe --tags --dirty --always --abbrev=12 || echo '<unknown>')"
-          CGO_ENABLED=1 \
-            go build -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -tags osusergo,netgo \
-            -o cni-plugin/out/calico \
-            ./cni-plugin/cmd/calico
-
-          CGO_ENABLED=1 \
-            go build -v -buildvcs=false \
-            -ldflags "$LDFLAGS" \
-            -tags osusergo,netgo \
-            -o cni-plugin/out/install \
-            ./cni-plugin/cmd/install
-      - runs: |
-          install -Dm755 cni-plugin/out/calico "${{targets.subpkgdir}}"/usr/bin/calico
-          ln -sf /usr/bin/calico "${{targets.subpkgdir}}"/usr/bin/calico-ipam
-
-          install -Dm755 cni-plugin/out/install "${{targets.subpkgdir}}"/usr/bin/calico-cni-install
-
-  - name: "calico-cni-compat-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-cni-compat=${{package.full-version}}
-      runtime:
-        - calico-cni
-        - flannel-cni-plugin-compat
-        - cni-plugins-loopback-compat
-        - cni-plugins-host-local-compat
-        - cni-plugins-portmap-compat
-        - cni-plugins-tuning-compat
-        - cni-plugins-bandwidth-compat
-    pipeline:
-      - runs: |
-          mkdir -p "${{targets.subpkgdir}}"/opt/cni/bin
-          ln -s /usr/bin/calico "${{targets.subpkgdir}}"/opt/cni/bin/calico
-          ln -s /usr/bin/calico "${{targets.subpkgdir}}"/opt/cni/bin/calico-ipam
-          ln -s /usr/bin/calico-cni-install "${{targets.subpkgdir}}"/opt/cni/bin/install
-
-  - name: "calico-apiserver-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-apiserver=${{package.full-version}}
-      runtime:
-        - glibc
-    pipeline:
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./apiserver/cmd/apiserver
-          output: calico-apiserver
-          ldflags: "-X github.com/projectcalico/calico/cmd/apiserver/server.VERSION=${{package.version}}) -X github.com/projectcalico/calico/cmd/apiserver/server.BUILD_DATE=$(date -u +'%FT%T%z') -X github.com/projectcalico/calico/cmd/apiserver/server.GIT_DESCRIPTION=$(git describe --tags) -X github.com/projectcalico/calico/cmd/apiserver/server.GIT_REVISION=$(git rev-parse --short HEAD)"
-
-  # https://github.com/projectcalico/calico/blob/master/apiserver/Dockerfile#L8
-  - name: "calico-apiserver-compat-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-apiserver-compat=${{package.full-version}}
-    pipeline:
-      - runs: |
-          mkdir -p "${{targets.subpkgdir}}"/code
-          ln -sf /usr/bin/calico-apiserver "${{targets.subpkgdir}}"/code/apiserver
-
-  - name: "calico-key-cert-provisioner-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-key-cert-provisioner=${{package.full-version}}
-      runtime:
-        - glibc
-    pipeline:
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./key-cert-provisioner/cmd/
-          output: calico-key-cert-provisioner
-
-  - name: "calico-app-policy-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-app-policy=${{package.full-version}}
-      runtime:
-        - glibc
-    pipeline:
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./app-policy/cmd/dikastes
-          output: calico-dikastes
-          ldflags: "-X github.com/projectcalico/calico/app-policy/buildinfo.GitVersion=$(git describe --tags --dirty --always --abbrev=12 || echo '<unknown>') -X github.com/projectcalico/calico/app-policy/buildinfo.BuildDate=$(date -u +'%FT%T%z') -X github.com/projectcalico/calico/app-policy/GitRevision=$(git rev-parse HEAD || echo '<unknown>') -B 0x$(git rev-parse HEAD || uuidgen | sed 's/-//g')"
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./app-policy/cmd/healthz
-          output: calico-healthz
-
-  - name: "calico-kube-controllers-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-kube-controllers=${{package.full-version}}
-      runtime:
-        - glibc-dev
-    pipeline:
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./kube-controllers/cmd/kube-controllers
-          output: calico-kube-controllers
-          ldflags: "-X main.VERSION=$(git describe --tags --dirty --always --abbrev=12)"
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./kube-controllers/cmd/check-status
-          output: check-status # keep naming convention as "check-status" is usually harded to /usr/bin/check-status
-          ldflags: "-X main.VERSION=$(git describe --tags --dirty --always --abbrev=12)"
-
-  - name: "calico-pod2daemon-${{vars.short-package-version}}"
-    description: "The calico pod2daemon components"
-    dependencies:
-      provides:
-        - calico-pod2daemon=${{package.full-version}}
-      runtime:
-        - glibc
-    pipeline:
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./pod2daemon/flexvol
-          output: calico-pod2daemon-flexvol
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./pod2daemon/csidriver
-          output: calico-pod2daemon-csidriver
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./pod2daemon/nodeagent
-          output: calico-pod2daemon-nodeagent
-      - runs: |
-          mkdir -p "${{targets.subpkgdir}}"/usr/bin
-          install -m755 ./pod2daemon/flexvol/docker-image/flexvol.sh "${{targets.subpkgdir}}"/usr/bin/flexvol.sh
-
-  - name: "calico-pod2daemon-flexvol-compat-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calico-pod2daemon-flexvol-compat=${{package.full-version}}
-    pipeline:
-      - runs: |
-          mkdir -p "${{targets.subpkgdir}}"/usr/local/bin
-          ln -sf /usr/bin/calico-pod2daemon-flexvol "${{targets.subpkgdir}}"/usr/local/bin/flexvol
-          ln -sf /usr/bin/flexvol.sh "${{targets.subpkgdir}}"/usr/local/bin/flexvol.sh
-
-  - name: "calicoctl-${{vars.short-package-version}}"
-    dependencies:
-      provides:
-        - calicoctl=${{package.full-version}}
-    pipeline:
-      - uses: go/build
-        with:
-          modroot: .
-          packages: ./calicoctl/calicoctl
-          output: calicoctl
-          ldflags: "-X github.com/projectcalico/calico/calicoctl/commands.VERSION=$(git describe --tags --dirty --always --abbrev=12) -X github.com/projectcalico/calico/calicoctl/commands.GIT_REVISION=$(git rev-parse --short HEAD) -X github.com/projectcalico/calico/calicoctl/commands/common.VERSION=$(git describe --tags --dirty --always --abbrev=12) -X main.VERSION=$(git describe --tags --dirty --always --abbrev=12)"
-
-  - name: "calico-typhad-${{vars.short-package-version}}"
-    description: "The calico typha daemon"
-    dependencies:
-      provides:
-        - calico-typhad=${{package.full-version}}
-      runtime:
-        - glibc
-    pipeline:
-      # TODO: I'm not sure yet if this actually needs CGO, or is just enabled upstream because of go-fips
-      - runs: |
-          LDFLAGS="-w"
-          LDFLAGS="$LDFLAGS -X github.com/projectcalico/calico/typha/pkg/buildinfo.GitVersion=$(git describe --tags --dirty --always --abbrev=12 || echo '<unknown>')"
-          LDFLAGS="$LDFLAGS -X github.com/projectcalico/calico/typha/pkg/buildinfo.BuildDate=$(date -u +'%FT%T%z')"
-          LDFLAGS="$LDFLAGS -X github.com/projectcalico/calico/typha/pkg/buildinfo.GitRevision=$(git rev-parse HEAD || echo '<unknown>')"
-          LDFLAGS="$LDFLAGS -B 0x$(git rev-parse HEAD || uuidgen | sed 's/-//g')"
-
-          mkdir -p "${{targets.subpkgdir}}"/usr/bin/
-          CGO_ENABLED=1 \
-            go build -v -tags cgo -v -buildvcs=false \
-            -o "${{targets.subpkgdir}}"/usr/bin/calico-typha \
-            ./typha/cmd/calico-typha
-
-          mkdir -p "${{targets.subpkgdir}}"/etc/calico
-          cp ./typha/docker-image/typha.cfg "${{targets.subpkgdir}}"/etc/calico/typha.cfg
-
-          mkdir -p "${{targets.subpkgdir}}"/licenses
-          cp ./typha/LICENSE "${{targets.subpkgdir}}"/licenses
-
-  - name: "calico-typha-client-${{vars.short-package-version}}"
-    description: "The calico typha client"
-    dependencies:
-      provides:
-        - calico-typha-client=${{package.full-version}}
-      runtime:
-        - glibc
-    pipeline:
-      # TODO: I'm not sure yet if this actually needs CGO, or is just enabled upstream because of go-fips
-      - runs: |
-          LDFLAGS="-w"
-          LDFLAGS="$LDFLAGS -X github.com/projectcalico/calico/typha/pkg/buildinfo.GitVersion=$(git describe --tags --dirty --always --abbrev=12 || echo '<unknown>')"
-          LDFLAGS="$LDFLAGS -X github.com/projectcalico/calico/typha/pkg/buildinfo.BuildDate=$(date -u +'%FT%T%z')"
-          LDFLAGS="$LDFLAGS -X github.com/projectcalico/calico/typha/pkg/buildinfo.GitRevision=$(git rev-parse HEAD || echo '<unknown>')"
-          LDFLAGS="$LDFLAGS -B 0x$(git rev-parse HEAD || uuidgen | sed 's/-//g')"
-
-          CGO_ENABLED=1 \
-            go build -v -tags osusergo,netgo,cgo -v -buildvcs=false \
-            -o "${{targets.subpkgdir}}"/usr/bin/typha-client \
-            ./typha/cmd/typha-client
-
-update:
-  enabled: true
-  github:
-    identifier: projectcalico/calico
-    strip-prefix: v
-    tag-filter: v3.28.
-
-test:
-  environment:
-    contents:
-      packages:
-        - calico-apiserver-${{vars.short-package-version}}
-        - calico-apiserver-compat-${{vars.short-package-version}}
-        - calico-cni-${{vars.short-package-version}}
-        - calico-cni-compat-${{vars.short-package-version}}
-        - calico-pod2daemon-${{vars.short-package-version}}
-        - calico-pod2daemon-flexvol-compat-${{vars.short-package-version}}
-        - calico-kube-controllers-${{vars.short-package-version}}
-        - calico-node-${{vars.short-package-version}}
-        - calico-typhad-${{vars.short-package-version}}
-        - calico-typha-client-${{vars.short-package-version}}
-  pipeline:
-    - name: Test binaries
-      runs: |
-        /usr/bin/calico-apiserver --help
-        /usr/bin/calico-cni-install 2>&1 | grep -q 'cni-installer'
-        /usr/bin/calico-pod2daemon-csidriver --help
-        /usr/bin/calico-pod2daemon-flexvol  --help
-        /usr/bin/calico-kube-controllers --help
-        /usr/sbin/start_runit 2>&1 | grep -q 'no configuration has been provided'
-        /usr/bin/calico-typha --help
-        /usr/bin/typha-client --help
-    - name: Test compat package paths
-      runs: |
-        /code/apiserver --help
-        /opt/cni/bin/install 2>&1 | grep -q 'cni-installer'
-        /usr/local/bin/flexvol --help