break out apt into separate module so it can restricted to a build-only dep