Using smart contracts, who does "apt upgrade" ? Where does the data come from ?