diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 566434c..e13c278 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,7 +3,7 @@
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: check-merge-conflict
       - id: check-shebang-scripts-are-executable
@@ -21,16 +21,21 @@ repos:
       - id: remove-tabs
 
   - repo: https://github.com/fsfe/reuse-tool.git
-    rev: v5.0.2
+    rev: v5.1.1
     hooks:
       - id: reuse
 
   - repo: https://github.com/commitizen-tools/commitizen.git
-    rev: v4.2.2
+    rev: v4.8.4
     hooks:
       - id: commitizen
         stages: [commit-msg]
 
+  - repo: https://github.com/EmbarkStudios/cargo-deny
+    rev: 0.18.4
+    hooks:
+      - id: cargo-deny
+
   - repo: local
     hooks:
       - id: rust-fmt
@@ -38,4 +43,4 @@ repos:
         language: system
         types: [rust]
         entry: rustfmt
-        args: ["--edition", "2021", "--config", "skip_children=true"]
+        args: ["--edition", "2024", "--config", "skip_children=true"]
diff --git a/Cargo.lock b/Cargo.lock
index 080ae12..16ed5e9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "adler2"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aho-corasick"
@@ -27,10 +27,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "anstream"
-version = "0.6.18"
+name = "allocator-api2"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "anstream"
+version = "0.6.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -43,67 +49,61 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.2"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.7"
+version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
+checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
 dependencies = [
  "anstyle",
- "once_cell",
- "windows-sys 0.59.0",
+ "once_cell_polyfill",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.95"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
+checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
 
 [[package]]
 name = "async-trait"
-version = "0.1.86"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "644dd749086bf3771a2fbc5f256fdb982d53f011c7d5d560304eafeecebce79d"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
-[[package]]
-name = "autocfg"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
-
 [[package]]
 name = "backtrace"
-version = "0.3.74"
+version = "0.3.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
 dependencies = [
  "addr2line",
  "cfg-if",
@@ -111,20 +111,20 @@ dependencies = [
  "miniz_oxide",
  "object",
  "rustc-demangle",
- "windows-targets",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
 name = "bitflags"
-version = "2.8.0"
+version = "2.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
+checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
 
 [[package]]
 name = "bstr"
-version = "1.11.3"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "531a9155a481e2ee699d4f98f43c0ca4ff8ee1bfd55c31e9e98fb29d2b176fe0"
+checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
 dependencies = [
  "memchr",
  "serde",
@@ -132,15 +132,21 @@ dependencies = [
 
 [[package]]
 name = "bytes"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f61dac84819c6588b558454b194026eb1f09c293b9036ae9b159e74e73ab6cf9"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+
+[[package]]
+name = "bytesize"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3c8f83209414aacf0eeae3cf730b18d6981697fba62f200fcfb92b9f082acba"
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
 
 [[package]]
 name = "cfg_aliases"
@@ -150,9 +156,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "clap"
-version = "4.5.30"
+version = "4.5.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92b7b18d71fad5313a1e320fa9897994228ce274b60faa4d694fe0ea89cd9e6d"
+checksum = "7eac00902d9d136acd712710d71823fb8ac8004ca445a89e73a41d45aa712931"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -160,9 +166,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.30"
+version = "4.5.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a35db2071778a7344791a4fb4f95308b5673d219dee3ae348b86642574ecc90c"
+checksum = "2ad9bbf750e73b5884fb8a211a9424a1906c1e156724260fdae972f31d70e1d6"
 dependencies = [
  "anstream",
  "anstyle",
@@ -172,9 +178,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.28"
+version = "4.5.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4ced95c6f4a675af3da73304b9ac4ed991640c36374e4b46795c49e17cf1ed"
+checksum = "bbfd7eae0b0f1a6e63d4b13c9c478de77c2eb546fba158ad50b4203dc24b9f9c"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -184,15 +190,15 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
+checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
 
 [[package]]
 name = "colorchoice"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
 [[package]]
 name = "crossbeam-deque"
@@ -231,14 +237,14 @@ dependencies = [
 
 [[package]]
 name = "env_logger"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0"
+checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
 dependencies = [
  "anstream",
  "anstyle",
  "env_filter",
- "humantime",
+ "jiff",
  "log",
 ]
 
@@ -254,6 +260,12 @@ version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "gimli"
 version = "0.31.1"
@@ -262,9 +274,9 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "globset"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15f1ce686646e7f1e19bf7d5533fe443a45dbfb990e00629110797578b42fb19"
+checksum = "54a1028dfc5f5df5da8a56a73e6c153c9a9708ec57232470703592a3f18e49f5"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -275,9 +287,9 @@ dependencies = [
 
 [[package]]
 name = "goblin"
-version = "0.9.3"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daa0a64d21a7eb230583b4c5f4e23b7e4e57974f96620f42a7e75e08ae66d745"
+checksum = "d6a80adfd63bd7ffd94fefc3d22167880c440a724303080e5aa686fa36abaa96"
 dependencies = [
  "log",
  "plain",
@@ -286,9 +298,14 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.2"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
 
 [[package]]
 name = "heck"
@@ -296,12 +313,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "humantime"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
-
 [[package]]
 name = "ignore"
 version = "0.4.23"
@@ -320,9 +331,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.7.1"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9c992b02b5b4c94ea26e32fe5bccb7aa7d9f390ab5c1221ff895bc7ea8b652"
+checksum = "f2481980430f9f78649238835720ddccc57e52df14ffce1c6f37391d61b563e9"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -330,9 +341,20 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.5"
+version = "2.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
+checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"
+
+[[package]]
+name = "io-uring"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "046fa2d4d00aea763528b4950358d0ead425372445dc8ff86312b3c69ff7727b"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "libc",
+]
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -341,67 +363,81 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
-name = "libc"
-version = "0.2.169"
+name = "jiff"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
-
-[[package]]
-name = "lock_api"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
 dependencies = [
- "autocfg",
- "scopeguard",
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde",
 ]
 
 [[package]]
-name = "log"
-version = "0.4.25"
+name = "jiff-static"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
+checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.175"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
+
+[[package]]
+name = "log"
+version = "0.4.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "memmap2"
-version = "0.9.5"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd3f7eed9d3848f8b98834af67102b720745c4ec028fcd0aa0239277e7de374f"
+checksum = "843a98750cd611cc2965a8213b53b43e715f13c37a9e096c6408e69990961db7"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.4"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b1c9bd4fe1f0f8b387f6eb9eb3b4a1aa26185e5750efb9140301703f62cd1b"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
 ]
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
  "wasi",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "nix"
-version = "0.29.0"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -419,42 +455,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "once_cell"
-version = "1.20.3"
+name = "once_cell_polyfill"
+version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
-
-[[package]]
-name = "parking_lot"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets",
-]
+checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
 
 [[package]]
 name = "petgraph"
-version = "0.7.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
+checksum = "54acf3a685220b533e437e264e4d932cfbdc4cc7ec0cd232ed73c08d03b8a7ca"
 dependencies = [
  "fixedbitset",
+ "hashbrown",
  "indexmap",
+ "serde",
 ]
 
 [[package]]
@@ -470,37 +485,43 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
 [[package]]
-name = "proc-macro2"
-version = "1.0.93"
+name = "portable-atomic"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
-dependencies = [
- "bitflags",
-]
-
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -510,9 +531,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -521,15 +542,15 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.24"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
 
 [[package]]
 name = "same-file"
@@ -540,26 +561,20 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
 [[package]]
 name = "scroll"
-version = "0.12.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab8598aa408498679922eff7fa985c25d58a90771bd6be794434c5277eab1a6"
+checksum = "c1257cd4248b4132760d6524d6dda4e053bc648c9070b960929bf50cfb1e7add"
 dependencies = [
  "scroll_derive",
 ]
 
 [[package]]
 name = "scroll_derive"
-version = "0.12.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f81c2fde025af7e69b1d1420531c8a8811ca898919db177141a85313b1cb932"
+checksum = "ed76efe62313ab6610570951494bdaa81568026e0318eaa55f167de70eeea67d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -568,18 +583,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -587,29 +602,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "signal-hook-registry"
-version = "1.4.2"
+name = "slab"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcf8323ef1faaee30a44a340193b1ac6814fd9b7b4e88e9d4519a3e4abe1cfd"
-
-[[package]]
-name = "socket2"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
+checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
 
 [[package]]
 name = "strsim"
@@ -619,9 +615,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "2.0.98"
+version = "2.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36147f1a48ae0ec2b5b3bc5b537d267457555a10dc06f3dbc8cb11ba3006d3b1"
+checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -630,10 +626,11 @@ dependencies = [
 
 [[package]]
 name = "sysroot-cleaner"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
+ "bytesize",
  "clap",
  "env_logger",
  "goblin",
@@ -649,20 +646,18 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.43.0"
+version = "1.47.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d61fa4ffa3de412bfea335c6ecff681de2b609ba3c77ef3e00e521813a9ed9e"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
  "backtrace",
  "bytes",
+ "io-uring",
  "libc",
  "mio",
- "parking_lot",
  "pin-project-lite",
- "signal-hook-registry",
- "socket2",
+ "slab",
  "tokio-macros",
- "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -678,9 +673,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "utf8parse"
@@ -700,27 +695,30 @@ dependencies = [
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
-name = "windows-sys"
-version = "0.52.0"
+name = "windows-link"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets",
-]
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
+[[package]]
+name = "windows-link"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45e46c0661abb7180e7b9c281db115305d49ca1709ab8242adf09666d2173c65"
 
 [[package]]
 name = "windows-sys"
@@ -728,7 +726,25 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.3",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e201184e40b2ede64bc2ea34968b28e33622acdbbf37104f0e4a33f7abe657aa"
+dependencies = [
+ "windows-link 0.2.0",
 ]
 
 [[package]]
@@ -737,14 +753,31 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
+dependencies = [
+ "windows-link 0.1.3",
+ "windows_aarch64_gnullvm 0.53.0",
+ "windows_aarch64_msvc 0.53.0",
+ "windows_i686_gnu 0.53.0",
+ "windows_i686_gnullvm 0.53.0",
+ "windows_i686_msvc 0.53.0",
+ "windows_x86_64_gnu 0.53.0",
+ "windows_x86_64_gnullvm 0.53.0",
+ "windows_x86_64_msvc 0.53.0",
 ]
 
 [[package]]
@@ -753,44 +786,92 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
diff --git a/Cargo.toml b/Cargo.toml
index 53bc72a..97b45fa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,22 +4,30 @@
 [package]
 name = "sysroot-cleaner"
 authors = ["Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>"]
-version = "0.1.0"
+description = "A tool to clean up sysroots for Linux embedded devices in order to save storage space"
 edition = "2024"
+version = "1.0.0"
 license = "EUPL-1.2"
 readme = "README.md"
 
+repository = "https://git.montecristosoftware.eu/matteo/sysroot-cleaner.git"
+homepage = "https://git.montecristosoftware.eu/matteo/sysroot-cleaner/"
+
+keywords = ["sysroot", "cleaner", "embedded", "buildroot", "filesystem"]
+categories = ["command-line-utilities", "development-tools::build-utils", "filesystem", "embedded"]
+
 [dependencies]
 anyhow = { version = "1.0" }
 async-trait = { version = "0.1" }
+bytesize = { version = "2.0" }
 clap = { version = "4.5", features = ["derive"] }
 env_logger = { version = "0.11" }
+goblin = { version = "0.10" }
 ignore = { version = "0.4" }
 indoc = { version = "2.0" }
-goblin = { version = "0.9" }
 log = { version = "0.4" }
 memmap2 = { version = "0.9" }
-nix = { version = "0.29", features = ["fs"] }
-petgraph = { version = "0.7" }
-tokio = { version = "1", features = ["full"] }
+nix = { version = "0.30", features = ["fs"] }
+petgraph = { version = "0.8" }
+tokio = { version = "1", features = ["rt-multi-thread", "io-util", "macros", "sync"] }
 walkdir = { version = "2" }
diff --git a/README.md b/README.md
index 09bd9d5..4f1e0ee 100644
--- a/README.md
+++ b/README.md
@@ -2,8 +2,71 @@
 
 [//]: # SPDX-License-Identifier: CC-BY-SA-4.0
 
-# Sysroot Cleaner
+# 🧹 Sysroot Cleaner
 
-A tool to clean up sysroots for Linux embedded devices to save storage space.
+A tool to clean up sysroots for Linux embedded devices in order to save storage space.
 
-Note: it will only work on files belonging to the same filesystem. This is a design choice.
\ No newline at end of file
+Here by sysroot we mean the final _target system_ filesystem, rather than the _staging folder_ potentially containing intermediate cross-compilation byproducts.
+
+## What does it do?
+
+_Sysroot cleaner_ is a simple tool used to remove unnecessary files from a target folder which is holding the filesystem of an ELF-based OS (such as Linux). This can for instance be either a cross-compiled device target tree, or a folder being prepared for a local chroot jail. It recurses across all subfolders **part of the same filesystem** and looks for files that can be safely removed to reduce space usage.
+
+The full list of found files is passed to a few modules (aka "cleaners") that can decide whether to keep or remove a specific file. These are:
+
+* **dso**: maps all ELF files and their library dependencies to a directed acyclic graph. For each library, remove it transitively if unreachanble from any executable binary. **Note**: Libraries that are dynamically opened at runtime need to be manually allow-listed. If there is interest, we might support [.note.dlopen](https://github.com/systemd/systemd/blob/main/docs/ELF_DLOPEN_METADATA.md) as it gains more widespread adoption.
+* **allow-/block-list**: given a file of [gitignore patterns](https://git-scm.com/docs/gitignore#_pattern_format), either mark the file for keeping (if in the allowlist) or for removal (if in the blocklist).
+
+## Commandline Options
+
+Usage: `sysroot-cleaner [option…] <sysroot>`, where `<sysroot>` is mandatory, and the path to the root of the sysroot to clean up.
+
+Options can be:
+
+* `-n`, `--dry-run`: Simulate operations without carrying them out.
+* `--split-to <dir>`: Instead of simply removing files, move them to the given location, preserving their relative folder structure.
+* `--allowlist <file>`: An allowlist of files to keep, in `.gitignore` format. Can be passed multiple times. **Note**: this will take precedence over all other removal decisions.
+* `--blocklist <file>`: A blocklist of files to remove, in `.gitignore` format. Can be passed multiple times.
+* `--output-dotfile <file>`: An optional path to save the file graph of the DSO cleaner in GraphViz format. Useful for debugging.
+* `--ld-path <dir>`: An additional path to consider when resolving libraries, relative to the sysroot root. Its behavior is similar of the one of the `LD_LIBRARY_PATH` environment variable when specified to the dynamic linker.
+
+The log level can be controlled via the `LOG_LEVEL` environment variable, and can be one of: `error`, `warn`, `info`, `debug`, `trace`, or `off` (run completely silent).
+
+## Example Usage
+
+Assume that you have built a filesystem image, for instance through a tool like [buildroot](https://buildroot.org/downloads/manual/manual.html).
+
+You could add a simple shell script to invoke `sysroot-cleaner`:
+
+```bash
+#!/bin/bash
+
+# file: post_build.sh
+
+set -e -o pipefail
+
+readonly SCRIPT_DIR=$(realpath "$(dirname $0)")
+readonly TARGET_DIR=$1
+
+if [ ! -d "${TARGET_DIR}" ]; then
+    echo "Expecting the rootfs folder as first argument"
+    exit 1
+fi
+
+# Base lists
+allow_lists=("${SCRIPT_DIR}/base.allowlist")
+block_lists=("${SCRIPT_DIR}/base.blocklist")
+
+LOG_LEVEL=info sysroot-cleaner \
+    $(printf -- '--allowlist %s ' "${allow_lists[@]}") \
+    $(printf -- '--blocklist %s ' "${block_lists[@]}") \
+    "${TARGET_DIR}"
+```
+
+Then, you can set `BR2_ROOTFS_POST_BUILD_SCRIPT` to invoke `post_build.sh`.
+
+## Changelog
+
+### v1.0.0
+
+* Initial stable release.
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..7700ee9
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,239 @@
+# SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+# SPDX-License-Identifier: CC0-1.0
+
+# This template contains all of the possible sections and their default values
+
+# Note that all fields that take a lint level have these possible values:
+# * deny - An error will be produced and the check will fail
+# * warn - A warning will be produced, but the check will not fail
+# * allow - No warning or error will be produced, though in some cases a note
+# will be
+
+# The values provided in this template are the default values that will be used
+# when any section or field is not specified in your own configuration
+
+# Root options
+
+# The graph table configures how the dependency graph is constructed and thus
+# which crates the checks are performed against
+[graph]
+# If 1 or more target triples (and optionally, target_features) are specified,
+# only the specified targets will be checked when running `cargo deny check`.
+# This means, if a particular package is only ever used as a target specific
+# dependency, such as, for example, the `nix` crate only being used via the
+# `target_family = "unix"` configuration, that only having windows targets in
+# this list would mean the nix crate, as well as any of its exclusive
+# dependencies not shared by any other crates, would be ignored, as the target
+# list here is effectively saying which targets you are building for.
+targets = [
+    # The triple can be any string, but only the target triples built in to
+    # rustc (as of 1.40) can be checked against actual config expressions
+    #"x86_64-unknown-linux-musl",
+    # You can also specify which target_features you promise are enabled for a
+    # particular target. target_features are currently not validated against
+    # the actual valid features supported by the target architecture.
+    #{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
+]
+# When creating the dependency graph used as the source of truth when checks are
+# executed, this field can be used to prune crates from the graph, removing them
+# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate
+# is pruned from the graph, all of its dependencies will also be pruned unless
+# they are connected to another crate in the graph that hasn't been pruned,
+# so it should be used with care. The identifiers are [Package ID Specifications]
+# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html)
+#exclude = []
+# If true, metadata will be collected with `--all-features`. Note that this can't
+# be toggled off if true, if you want to conditionally enable `--all-features` it
+# is recommended to pass `--all-features` on the cmd line instead
+all-features = true
+# If true, metadata will be collected with `--no-default-features`. The same
+# caveat with `all-features` applies
+no-default-features = false
+# If set, these feature will be enabled when collecting metadata. If `--features`
+# is specified on the cmd line they will take precedence over this option.
+#features = []
+
+# The output table provides options for how/if diagnostics are outputted
+[output]
+# When outputting inclusion graphs in diagnostics that include features, this
+# option can be used to specify the depth at which feature edges will be added.
+# This option is included since the graphs can be quite large and the addition
+# of features from the crate(s) to all of the graph roots can be far too verbose.
+# This option can be overridden via `--feature-depth` on the cmd line
+feature-depth = 1
+
+# This section is considered when running `cargo deny check advisories`
+# More documentation for the advisories section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
+[advisories]
+# The path where the advisory databases are cloned/fetched into
+#db-path = "$CARGO_HOME/advisory-dbs"
+# The url(s) of the advisory databases to use
+#db-urls = ["https://github.com/rustsec/advisory-db"]
+# A list of advisory IDs to ignore. Note that ignored advisories will still
+# output a note when they are encountered.
+ignore = [
+    #"RUSTSEC-0000-0000",
+    #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
+    #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish
+    #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" },
+]
+# If this is true, then cargo deny will use the git executable to fetch advisory database.
+# If this is false, then it uses a built-in git library.
+# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
+# See Git Authentication for more information about setting up git authentication.
+#git-fetch-with-cli = true
+
+# This section is considered when running `cargo deny check licenses`
+# More documentation for the licenses section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
+[licenses]
+# List of explicitly allowed licenses
+# See https://spdx.org/licenses/ for list of possible licenses
+# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
+allow = [
+    "Apache-2.0",
+    "EUPL-1.2",
+    "MIT",
+]
+# The confidence threshold for detecting a license from license text.
+# The higher the value, the more closely the license text must be to the
+# canonical license text of a valid SPDX license file.
+# [possible values: any between 0.0 and 1.0].
+confidence-threshold = 0.8
+# Allow 1 or more licenses on a per-crate basis, so that particular licenses
+# aren't accepted for every possible crate as with the normal allow list
+exceptions = [
+    # Each entry is the crate and version constraint, and its specific allow
+    # list
+    { allow = ["Zlib"], crate = "foldhash" },
+    { allow = ["Unicode-3.0"], crate = "unicode-ident" },
+]
+
+# Some crates don't have (easily) machine readable licensing information,
+# adding a clarification entry for it allows you to manually specify the
+# licensing information
+#[[licenses.clarify]]
+# The package spec the clarification applies to
+#crate = "ring"
+# The SPDX expression for the license requirements of the crate
+#expression = "MIT AND ISC AND OpenSSL"
+# One or more files in the crate's source used as the "source of truth" for
+# the license expression. If the contents match, the clarification will be used
+# when running the license check, otherwise the clarification will be ignored
+# and the crate will be checked normally, which may produce warnings or errors
+# depending on the rest of your configuration
+#license-files = [
+# Each entry is a crate relative path, and the (opaque) hash of its contents
+#{ path = "LICENSE", hash = 0xbd0eed23 }
+#]
+
+[licenses.private]
+# If true, ignores workspace crates that aren't published, or are only
+# published to private registries.
+# To see how to mark a crate as unpublished (to the official registry),
+# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
+ignore = false
+# One or more private registries that you might publish crates to, if a crate
+# is only published to private registries, and ignore is true, the crate will
+# not have its license(s) checked
+registries = [
+    #"https://sekretz.com/registry
+]
+
+# This section is considered when running `cargo deny check bans`.
+# More documentation about the 'bans' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
+[bans]
+# Lint level for when multiple versions of the same crate are detected
+multiple-versions = "warn"
+# Lint level for when a crate version requirement is `*`
+wildcards = "allow"
+# The graph highlighting used when creating dotgraphs for crates
+# with multiple versions
+# * lowest-version - The path to the lowest versioned duplicate is highlighted
+# * simplest-path - The path to the version with the fewest edges is highlighted
+# * all - Both lowest-version and simplest-path are used
+highlight = "all"
+# The default lint level for `default` features for crates that are members of
+# the workspace that is being checked. This can be overridden by allowing/denying
+# `default` on a crate-by-crate basis if desired.
+workspace-default-features = "allow"
+# The default lint level for `default` features for external crates that are not
+# members of the workspace. This can be overridden by allowing/denying `default`
+# on a crate-by-crate basis if desired.
+external-default-features = "allow"
+# List of crates that are allowed. Use with care!
+allow = [
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" },
+]
+# List of crates to deny
+deny = [
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" },
+    # Wrapper crates can optionally be specified to allow the crate when it
+    # is a direct dependency of the otherwise banned crate
+    #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] },
+]
+
+# List of features to allow/deny
+# Each entry the name of a crate and a version range. If version is
+# not specified, all versions will be matched.
+#[[bans.features]]
+#crate = "reqwest"
+# Features to not allow
+#deny = ["json"]
+# Features to allow
+#allow = [
+#    "rustls",
+#    "__rustls",
+#    "__tls",
+#    "hyper-rustls",
+#    "rustls",
+#    "rustls-pemfile",
+#    "rustls-tls-webpki-roots",
+#    "tokio-rustls",
+#    "webpki-roots",
+#]
+# If true, the allowed features must exactly match the enabled feature set. If
+# this is set there is no point setting `deny`
+#exact = true
+
+# Certain crates/versions that will be skipped when doing duplicate detection.
+skip = [
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" },
+]
+# Similarly to `skip` allows you to skip certain crates during duplicate
+# detection. Unlike skip, it also includes the entire tree of transitive
+# dependencies starting at the specified crate, up to a certain depth, which is
+# by default infinite.
+skip-tree = [
+    #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies
+    #{ crate = "ansi_term@0.11.0", depth = 20 },
+]
+
+# This section is considered when running `cargo deny check sources`.
+# More documentation about the 'sources' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
+[sources]
+# Lint level for what to happen when a crate from a crate registry that is not
+# in the allow list is encountered
+unknown-registry = "warn"
+# Lint level for what to happen when a crate from a git repository that is not
+# in the allow list is encountered
+unknown-git = "warn"
+# List of URLs for allowed crate registries. Defaults to the crates.io index
+# if not specified. If it is specified but empty, no registries are allowed.
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+# List of URLs for allowed Git repositories
+allow-git = []
+
+[sources.allow-org]
+# github.com organizations to allow git sources for
+github = []
+# gitlab.com organizations to allow git sources for
+gitlab = []
+# bitbucket.org organizations to allow git sources for
+bitbucket = []
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index bd781f6..ada8778 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,8 +1,7 @@
 # SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
 # SPDX-License-Identifier: CC0-1.0
 
-
 [toolchain]
-channel = "1.85"
+channel = "stable"
 profile = "default"
 components = ["rustfmt"]
diff --git a/src/args.rs b/src/args.rs
index af165ae..aa4d8ac 100644
--- a/src/args.rs
+++ b/src/args.rs
@@ -3,7 +3,30 @@
 
 use std::path::PathBuf;
 
-use clap::Parser;
+use clap::{
+    builder::{PathBufValueParser, TypedValueParser},
+    Parser,
+};
+
+#[derive(Clone, Default)]
+struct AbsolutePathBufValueParser;
+
+impl TypedValueParser for AbsolutePathBufValueParser {
+    type Value = PathBuf;
+
+    fn parse_ref(
+        &self,
+        cmd: &clap::Command,
+        arg: Option<&clap::Arg>,
+        value: &std::ffi::OsStr,
+    ) -> Result<Self::Value, clap::Error> {
+        let pathbuf_parser = PathBufValueParser::new();
+        let v = pathbuf_parser.parse_ref(cmd, arg, value)?;
+
+        v.canonicalize()
+            .map_err(|e| clap::Error::raw(clap::error::ErrorKind::Io, e))
+    }
+}
 
 /// A tool to clean up sysroots for Linux embedded devices to save storage space.
 #[derive(Parser, Debug)]
@@ -19,13 +42,15 @@ pub struct Args {
     pub split_to: Option<PathBuf>,
 
     /// An allowlist of files to keep, in .gitignore format.
+    /// Can be passed multiple times.
     /// Note: this will take precedence over all other removal decisions.
-    #[arg(long)]
-    pub allowlist: Option<PathBuf>,
+    #[arg(long, value_parser = AbsolutePathBufValueParser::default())]
+    pub allowlist: Vec<PathBuf>,
 
     /// A blocklist of files to remove, in .gitignore format.
+    /// Can be passed multiple times.
     #[arg(long)]
-    pub blocklist: Option<PathBuf>,
+    pub blocklist: Vec<PathBuf>,
 
     /// An optional path to save the file graph of the DSO cleaner
     /// in GraphViz format. Useful for debugging.
@@ -34,4 +59,20 @@ pub struct Args {
 
     /// The location of the sysroot to clean up
     pub sysroot_location: PathBuf,
+
+    /// An additional path to consider when resolving
+    /// libraries, relative to the sysroot.
+    /// Their behavior is similar of the one of the
+    /// `LD_LIBRARY_PATH` environment variable when
+    /// specified to the dynamic linker.
+    #[arg(long = "ld-path", value_parser = relativize_path)]
+    pub extra_library_paths: Vec<PathBuf>,
+}
+
+fn relativize_path(arg: &str) -> anyhow::Result<PathBuf> {
+    let mut p = PathBuf::from(arg);
+    if p.is_absolute() {
+        p = p.strip_prefix("/")?.into();
+    }
+    Ok(p)
 }
diff --git a/src/cleaners.rs b/src/cleaners.rs
index 925937e..124f6e5 100644
--- a/src/cleaners.rs
+++ b/src/cleaners.rs
@@ -10,10 +10,11 @@ use crate::{
 };
 use anyhow::{Error, Result};
 use async_trait::async_trait;
+use bytesize::ByteSize;
 use dso::DsoCleaner;
 use list::ListCleaner;
 use nix::libc::EXDEV;
-use std::{collections::HashMap, io, path::Path};
+use std::{collections::HashMap, fmt, io, ops::AddAssign, path::Path};
 use tokio::{sync::mpsc, task::JoinSet};
 use walkdir::{DirEntry, WalkDir};
 
@@ -26,8 +27,22 @@ pub trait Cleaner {
     ) -> Result<()>;
 }
 
+struct FileSize(u64);
+
+impl fmt::Display for FileSize {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "{}", ByteSize(self.0))
+    }
+}
+
+impl AddAssign for FileSize {
+    fn add_assign(&mut self, rhs: Self) {
+        self.0.add_assign(rhs.0);
+    }
+}
+
 type Cleaners = Vec<Box<dyn Cleaner + Send>>;
-type RemovalFn = Box<dyn Fn(&Path) -> io::Result<()>>;
+type RemovalFn = Box<dyn Fn(&Path) -> io::Result<FileSize>>;
 
 pub struct Runner {
     cleaners: Cleaners,
@@ -41,15 +56,18 @@ impl Runner {
         let removal_fn = Self::new_removal_fn(&args);
         let mut cleaners: Cleaners = vec![];
 
-        if let Some(wl) = args.allowlist {
+        for wl in args.allowlist {
             cleaners.push(Box::new(ListCleaner::new(list::ListType::Allow, wl)));
         }
 
-        if let Some(bl) = args.blocklist {
+        for bl in args.blocklist {
             cleaners.push(Box::new(ListCleaner::new(list::ListType::Block, bl)));
         }
 
-        cleaners.push(Box::new(DsoCleaner::new(args.output_dotfile)));
+        cleaners.push(Box::new(DsoCleaner::new(
+            args.extra_library_paths,
+            args.output_dotfile,
+        )));
 
         Self {
             cleaners,
@@ -129,6 +147,8 @@ impl Runner {
 
     async fn final_decision(removal_fn: RemovalFn, mut output_rx: mpsc::Receiver<Decision>) {
         let mut final_decisions = HashMap::new();
+        let mut total_removed_size = FileSize(0);
+
         while let Some(input_decision) = output_rx.recv().await {
             if input_decision.action == Action::Undecided {
                 continue;
@@ -147,57 +167,85 @@ impl Runner {
 
         for (file, action) in final_decisions {
             if action == Action::Remove {
-                if let Err(err) = (removal_fn)(&file) {
-                    log::error!("{}: {}", file.display(), err);
-                }
+                let removed_size = match (removal_fn)(&file) {
+                    Ok(size) => size,
+                    Err(err) => {
+                        log::error!("{}: {}", file.display(), err);
+                        FileSize(0)
+                    }
+                };
+                total_removed_size += removed_size;
             }
         }
+        log::info!("Total space removed: {}", total_removed_size);
     }
 
     fn new_removal_fn(args: &Args) -> RemovalFn {
         if let Some(dest) = args.split_to.clone() {
             if args.dry_run {
                 Box::new(move |path| {
+                    let size = Self::get_file_size(path)?;
                     log::info!(
-                        "(dry-run) would move {} to {}",
+                        "(dry-run) would move {} to {} ({})",
                         path.display(),
-                        dest.display()
+                        dest.display(),
+                        size
                     );
-                    Ok(())
+                    Ok(size)
                 })
             } else {
                 Box::new(move |path| {
-                    log::info!("moving {} to {}", path.display(), dest.display());
-                    Self::move_preserve(&path, &dest)
+                    let size = Self::get_file_size(path)?;
+                    log::info!("moving {} to {} ({})", path.display(), dest.display(), size);
+                    Self::move_preserve(path, &dest)?;
+                    Ok(size)
                 })
             }
+        } else if args.dry_run {
+            Box::new(|path| {
+                let ty = if path.is_symlink() {
+                    "symlink"
+                } else {
+                    "regular file"
+                };
+                let size = Self::get_file_size(path)?;
+                log::info!(
+                    "(dry-run) would remove {} {} ({})",
+                    ty,
+                    path.display(),
+                    size
+                );
+                Ok(size)
+            })
         } else {
-            if args.dry_run {
-                Box::new(|path| {
-                    let ty = if path.is_symlink() {
-                        "symlink"
-                    } else {
-                        "regular file"
-                    };
-                    log::info!("(dry-run) would remove {} {}", ty, path.display());
-                    Ok(())
-                })
-            } else {
-                Box::new(move |path| {
-                    log::info!("removing {}", path.display());
-                    std::fs::remove_file(&path)
-                })
-            }
+            Box::new(move |path| {
+                let size = Self::get_file_size(path)?;
+                log::info!("removing {} ({})", path.display(), size);
+                std::fs::remove_file(path)?;
+                Ok(size)
+            })
         }
     }
 
+    fn get_file_size(file: &Path) -> io::Result<FileSize> {
+        let lstat = nix::sys::stat::lstat(file);
+        let size = match lstat {
+            Err(err) => {
+                log::error!("failed to get metadata from: {}, {}", file.display(), err);
+                FileSize(0)
+            }
+            Ok(lstat) => FileSize(lstat.st_size as u64),
+        };
+        Ok(size)
+    }
+
     fn move_preserve(src: &Path, dest: &Path) -> io::Result<()> {
         assert!(src.is_relative());
         let abs_dest = dest.join(src);
         if let Some(parent) = abs_dest.parent() {
             std::fs::create_dir_all(parent)?;
         }
-        match std::fs::rename(&src, &abs_dest) {
+        match std::fs::rename(src, &abs_dest) {
             Err(err) if err.raw_os_error() == Some(EXDEV) => {
                 log::trace!(
                     "different filesystems, falling back to copying {} to {}",
diff --git a/src/cleaners/dso.rs b/src/cleaners/dso.rs
index 7aea0fe..87b8b9f 100644
--- a/src/cleaners/dso.rs
+++ b/src/cleaners/dso.rs
@@ -27,17 +27,22 @@ type InodeGraph = DiGraphMap<ino_t, ()>;
 /// Cleans up unused shared libraries
 /// and warns about broken dependencies as well
 pub struct DsoCleaner {
+    extra_library_paths: Vec<PathBuf>,
     output_dot: Option<PathBuf>,
 }
 
 struct State {
+    ld_library_path: Vec<String>,
     paths_map: InodeMap,
     graph: InodeGraph,
 }
 
 impl DsoCleaner {
-    pub fn new(output_dot: Option<PathBuf>) -> Self {
-        Self { output_dot }
+    pub fn new(extra_library_paths: Vec<PathBuf>, output_dot: Option<PathBuf>) -> Self {
+        Self {
+            extra_library_paths,
+            output_dot,
+        }
     }
 }
 
@@ -52,6 +57,11 @@ impl Cleaner for DsoCleaner {
         output: mpsc::Sender<Decision>,
     ) -> Result<()> {
         let mut state = State::default();
+        state.ld_library_path = self
+            .extra_library_paths
+            .iter()
+            .map(|p| p.to_str().unwrap().to_owned())
+            .collect();
 
         let mut inodes_to_keep = HashSet::new();
         inodes_to_keep.insert(ROOT_NODE);
@@ -62,7 +72,7 @@ impl Cleaner for DsoCleaner {
             // that also its dependencies will not be kept.
             if decision.action != Action::Remove {
                 state.process_path(&decision.path).unwrap_or_else(|e| {
-                    log::warn!(
+                    log::error!(
                         "{}: {} (this might produce wrong results!)",
                         decision.path.display(),
                         e
@@ -92,12 +102,12 @@ impl Cleaner for DsoCleaner {
         }
 
         if let Some(dot) = &self.output_dot {
-            state.debug_print_graph(&dot)?;
+            state.debug_print_graph(dot)?;
         }
 
         let mut dfs = Dfs::empty(&state.graph);
         dfs.stack = inodes_to_keep.into_iter().collect();
-        while let Some(_) = dfs.next(&state.graph) {}
+        while dfs.next(&state.graph).is_some() {}
 
         for (inode, paths) in state.paths_map.into_iter() {
             let action = if !dfs.discovered.contains(&inode) {
@@ -127,7 +137,11 @@ impl Default for State {
         paths_map.insert(ROOT_NODE, HashSet::from([fake_root_node]));
         graph.add_node(ROOT_NODE);
 
-        Self { paths_map, graph }
+        Self {
+            ld_library_path: vec![],
+            paths_map,
+            graph,
+        }
     }
 }
 
@@ -159,7 +173,7 @@ impl State {
         }
 
         let current_dir = std::env::current_dir()?;
-        let mut dst_path = std::fs::read_link(path)?;
+        let mut dst_path = fs::read_link(path)?;
         if dst_path.is_absolute() {
             dst_path = dst_path.strip_prefix("/")?.into();
         } else {
@@ -196,11 +210,13 @@ impl State {
             self.update_graph("".into(), ROOT_NODE, path.to_owned(), src.st_ino);
         }
 
-        let search_paths = determine_lib_search_paths(path, elf)?;
+        let search_paths = self.determine_lib_search_paths(path, elf)?;
+        log::trace!("determined search paths {:#?}", search_paths);
 
         'next_lib: for &library in elf.libraries.iter() {
             for lib_path in search_paths.iter() {
-                let tentative_path = PathBuf::from(lib_path).strip_prefix("/")?.join(library);
+                assert!(Path::new(&lib_path).is_relative());
+                let tentative_path = PathBuf::from(lib_path).join(library);
                 let dst = match nix::sys::stat::lstat(&tentative_path) {
                     Ok(dst) => dst,
                     Err(Errno::ENOENT) => continue,
@@ -219,7 +235,11 @@ impl State {
                 continue 'next_lib;
             }
 
-            anyhow::bail!("{}: unable to find library {}", path.display(), library);
+            log::warn!(
+                "{}: unable to find library {}, ignoring (this might produce wrong results)!",
+                path.display(),
+                library
+            );
         }
 
         Ok(())
@@ -257,7 +277,7 @@ impl State {
                     {:?}
                 }}"
             },
-            petgraph::dot::Dot::with_attr_getters(
+            dot::Dot::with_attr_getters(
                 &self.graph,
                 &[
                     dot::Config::NodeNoLabel,
@@ -267,10 +287,12 @@ impl State {
                 &|_, _| { String::new() },
                 &|_, n| {
                     let paths = self.paths_map.get(&n.id()).unwrap();
-                    let first_path = paths.iter().next().expect(&format!(
-                        "dso: you have a path map with an empty entry for inode {}",
-                        n.id()
-                    ));
+                    let first_path = paths.iter().next().unwrap_or_else(|| {
+                        panic!(
+                            "dso: you have a path map with an empty entry for inode {}",
+                            n.id()
+                        )
+                    });
                     format!(
                         "label = \"({}, {})\"",
                         n.weight(),
@@ -284,60 +306,45 @@ impl State {
         )?;
         Ok(())
     }
-}
 
-fn determine_lib_search_paths(path: &Path, elf: &Elf<'_>) -> Result<Vec<String>> {
-    let mut search_paths = vec![];
+    // Contract: only relative paths starting from the sysroot dir should be returned from this function
+    fn determine_lib_search_paths(&self, path: &Path, elf: &Elf<'_>) -> Result<Vec<String>> {
+        log::trace!(
+            "{}: elf.runpaths = {:#?}, elf.rpaths = {:#?}",
+            path.display(),
+            elf.runpaths,
+            elf.rpaths
+        );
 
-    let current_dir = std::env::current_dir()?;
-    let origin = std::fs::canonicalize(path)?
-        .parent()
-        .unwrap()
-        .strip_prefix(current_dir)?
-        .to_path_buf()
-        .into_os_string()
-        .into_string()
-        .map_err(|s| anyhow::anyhow!("cannot represent {:?} as a UTF-8 string", s))?;
+        let current_dir = std::env::current_dir()?;
+        let origin = fs::canonicalize(path)?
+            .parent()
+            .unwrap()
+            .strip_prefix(current_dir)?
+            .to_path_buf()
+            .into_os_string()
+            .into_string()
+            .map_err(|s| anyhow::anyhow!("cannot represent {:?} as a UTF-8 string", s))?;
 
-    if elf.rpaths != vec![""] {
-        if elf.runpaths != vec![""] {
-            let mut rpaths = elf
-                .rpaths
-                .iter()
-                .map(|p| p.replace("$ORIGIN", &origin))
-                .collect::<Vec<_>>();
-            search_paths.append(&mut rpaths);
+        let mut search_paths = vec![];
+        if elf.runpaths.is_empty() {
+            search_paths.extend(collect_paths(&elf.rpaths, &origin));
         }
 
-        search_paths.append(&mut get_env_library_paths());
+        search_paths.extend(self.ld_library_path.clone());
+        search_paths.extend(collect_paths(&elf.runpaths, &origin));
+        search_paths.extend(["usr/local/lib".into(), "lib".into(), "usr/lib".into()]);
+        Ok(search_paths)
     }
-
-    if elf.runpaths != vec![""] {
-        let mut runpaths = elf
-            .runpaths
-            .iter()
-            .map(|p| p.replace("$ORIGIN", &origin))
-            .collect::<Vec<_>>();
-        search_paths.append(&mut runpaths);
-    }
-
-    search_paths.push("/usr/local/lib".into());
-    search_paths.push("/lib".into());
-    search_paths.push("/usr/lib".into());
-    Ok(search_paths)
 }
 
-fn get_env_library_paths() -> Vec<String> {
-    let ld_config_path = std::env::var("LD_LIBRARY_PATH");
-    ld_config_path
-        .as_ref()
-        .map(|env| {
-            env.split(':')
-                .filter(|s| s.is_empty())
-                .map(|s| s.into())
-                .collect()
-        })
-        .unwrap_or_default()
+fn collect_paths(elf_paths: &Vec<&str>, origin: &str) -> impl Iterator<Item = String> {
+    elf_paths
+        .iter()
+        .flat_map(|&p| p.split(':')) // Split multiple elements in r(un)?path separated by ':'
+        .filter(|&p| !p.is_empty()) // ignore empty items
+        .map(|p| p.replace("$ORIGIN", origin)) // replace $ORIGIN with path rel to sysroot
+        .map(|p| p.trim_start_matches('/').to_string()) // relativize paths from sysroot
 }
 
 fn is_elf(f: &mut File) -> Result<bool> {