image builds broken: c/_cffi_backend.c:15:17: fatal error: ffi.h: No such file or directory

gate and local builds are broken:

http://logs.openstack.org/44/317744/1/check/gate-functional-dsvm-astara-appliance-src/bdede77/logs/devstacklog.txt.gz#_2016-05-17_23_43_47_466

The image build fails on a missing build dependency:

05-17 23:43:47.466 | running build_ext
 11 2016-05-17 23:43:47.466 | building '_cffi_backend' extension
 10 2016-05-17 23:43:47.466 | creating build/temp.linux-x86_64-2.7
  9 2016-05-17 23:43:47.466 | creating build/temp.linux-x86_64-2.7/c
  8 2016-05-17 23:43:47.466 | x86_64-linux-gnu-gcc -pthread -DNDEBUG -g -fwrapv -O2 -Wall -Wstrict-prototypes -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -g -fstack-protector-strong -Wformat -Werror=format-security -fPIC -DUSE__THREAD -I/usr/include/ffi -I/usr/include/libffi -I/usr/include/python2.7 -c c/_cffi _backend.c -o build/temp.linux-x86_64-2.7/c/_cffi_backend.o
  7 2016-05-17 23:43:47.466 | c/_cffi_backend.c:15:17: fatal error: ffi.h: No such file or directory
  6 2016-05-17 23:43:47.466 | #include <ffi.h>
  5 2016-05-17 23:43:47.466 | ^
  4 2016-05-17 23:43:47.466 | compilation terminated.
  3 2016-05-17 23:43:47.466 | error: command 'x86_64-linux-gnu-gcc' failed with exit status 1
  2 2016-05-17 23:43:47.466 |

In the astara-appliance's ansible DIB element, we install a couple of pip requirements:

https://git.openstack.org/cgit/openstack/astara-appliance/tree/diskimage-builder/elements/ansible/install.d/ansible-source-install/30-ansible-source#n30

$ANSIBLE_VENV_DIR/bin/pip install paramiko PyYAML jinja2 httplib2

Note that these are unconstrainted wrt versions. Looks like we now pull in a newer paramiko 2.0, which swapped its pycrypto dependency for the cryptography library, which requires libffi-dev to build.