provision: do upgrade before install