add tools/sandbox.sh
add suffix .so.1 to ffi_lib calls so that dep to -dev .deb is removed