A view from the "other side"

> There are tools like Fossology around but at the moment for me Fossology seems like a
> file parser that hunts for keywords like "copyright" or "license" and just checks your
> sources, but not the runtime libs.

You may want to check tow tools of mine:

- https://github.com/nexB/scancode-toolkit/ is a modern alternative to Fossology. It does a bit much more and also looks into binaries. Upcoming features include more advanced analysis of binaries with some GSoC projects: https://fosdem.org/2017/schedule/event/whats_in_your_binary/

- https://github.com/nexB/tracecode-build is a build tracer. One of the applications is to get a detailed knowledge of which files are linked statically or dynamically. I presented it at FOSDEM: https://fosdem.org/2017/schedule/event/whats_in_your_binary/

/HTH