Google's John Mueller said in a Google Webmaster Help thread that you should only include the URLs you want Google to index in your sitemap file, not the other variations. This is probably obvious to many of you, but nowadays I what I think is obvious, isn't always obvious to me.
So, don't include your HTTP and your HTTPS, if you are on HTTPS, just submit your HTTPS URLs in your sitemap file. Don't include both the WWW and non WWW, pick one. The final canonical version of what you want Google to index is what you should include in your sitemap, the rest, 301 redirect to the main canonical URL.
John wrote, "we recommend just submitting a sitemap for the URLs that you want to have indexed, not for all variations."
Forum discussion at Google Webmaster Help.
