LGTM
@mtrmac PTAL

@mtrmac The README indeed categorizes containers/image as "image is a set of Go libraries", implying its main purpose is to be imported by users. Each time a user imports the package, it automatically imports its dependencies. This reduces download speed and increases the user's application dependency list. To maintain efficient use and management, it's critical to keep a minimal list of dependencies.

Adding to this, having fewer dependencies enhances the overall control we have on the application. Reviewing and adding 55 lines of code is a one-time task. But every extra dependency is an added layer of complexity, potential security risk, and another component that should be maintained and kept updated. We are simplifying the application maintenance process by trimming down dependencies, just as Rob Pike mentioned about keeping the dependency tree small (check video).

https://medium.com/@cep21/aspects-of-a-good-go-library-7082beabb403

Each time a user imports the package, it automatically imports its dependencies.

I mean…

% cat foo.go 
package foo

import "github.com/containers/image/v5/oci/layout"

func main() {
  _ = layout.Transport
}
% go mod tidy && go mod vendor
% grep -lr 10/copy
./go.sum

Test-only dependencies don’t really “infect” the consumer.

Actually, you're right. Test dependencies won't inflect customer since Go 1.18. Found this change
https://go-review.googlesource.com/c/go/+/357310/

Closing PR.