.tar-exclude

# the file we store the "epoch" of a given rootfs in
./garden-epoch

# "/dev" is a special case in "garden-tar"
#./dev/**
./proc/**
./sys/**
./run/**
./tmp/**

# targeted exclusions to get rid of everything except "/var/cache/apt/archives/partial" and "/var/lib/apt/lists/partial"
# (https://salsa.debian.org/apt-team/apt/commit/1cd1c398d18b78f4aa9d882a5de5385f4538e0be)
./var/cache/apt/*.bin
./var/cache/apt/archives/*.deb
./var/cache/apt/archives/lock
./var/lib/apt/lists/*Packages*
./var/lib/apt/lists/*Release*
./var/lib/apt/lists/lock
# https://salsa.debian.org/apt-team/apt/commit/5555ef9850b7e66aa02d39bb7d624fdf3e43edb2 (APT 0.9.14 removed support for /var/state/apt)
./var/state/apt/lists/*Packages*
./var/state/apt/lists/*Release*
./var/state/apt/lists/lock

# ends up with host-kernel info
./etc/apt/apt.conf.d/01autoremove-kernels

# useful data in these, but includes timestamps too
./var/log/apt/history.log
./var/log/apt/term.log

# wheezy-only file which contains host-kernel info
./run/motd.dynamic

# wheezy-only file which APT doesn't even use (and has timestamp embedded in binary data)
# see https://github.com/debuerreotype/debuerreotype/issues/7
./etc/apt/trustdb.gpg

# a wheezy-only file which only shows up when building via debootstrap in buster+ for some reason
./run/shm/.run-transition

# Debian creates this file reproducibly, but Ubuntu does not
# (according to "man 1 journalctl", this is automatically recreated by "journalctl --update-catalog")
# Tails also removes this file to achieve reproducibility (https://labs.riseup.net/code/projects/tails/repository/revisions/b1e05c8aac12fc79293f6a220b40a538d4f38c51/diff/config/chroot_local-hooks/99-zzzzzz_reproducible-builds-post-processing)
./var/lib/systemd/catalog/database