See containers/image#2590

To summarize, the goal here is something like skopeo copy containers-storage:[overlay@srcpath+srcrunroot:trusted=true]registry.redhat.io/ubi9/ubi:latest copy containers-storage:[overlay@destpath+destrunroot]registry.redhat.io/ubi9/ubi:latest (copying between two c/storage instances) in a "bit for bit" style manner; we wouldn't attempt to re-serialize the source image into a new manifest (with uncompressed data).

Implicitly in this we're currently trusting the source - we're not re-verifying the signature vs the source manifest etc. It's "just a copy".