It doesn't find dependencies like /etc/ssl/certs/ca-certificates.crt or /usr/share/zoneinfo.

ah, thanks.

I've been playing with a project to do this. The first major obvious problem is anything that uses dlopen won't necessarily get all that it needs.

Yes. Grepping the code or fighting runtime errors are two complementary approaches I can think of... Not sure if there are other methods.