Found it. After an upgrade, "puppet-common" is left instate "removed".
When that package is purged (manually or automatically), /var/lib/puppet is removed. When looking at debian/puppet-common.postrm from puppet 3.8, it contains a "rm -rf /var/lib/puppet" when called with "purge". -- Stig Sandbeck Mathisen
signature.asc
Description: PGP signature
