We are currently using the umoci command from our client package rather than importing the relevant Go packages from umoci and running things in-process.

By moving to the native Go packages from umoci, we should be able to not only remove an external dependency but also save ourselves a bit of time by being able to directly unpack the data retrieved by skopeo into the resulting tarball by using some of the VFS abstractions from umoci.