I've send a patches regarding reproducible builds. debian/rules uses mkrescue and it's uuid comes from a timestamp. https://lists.gnu.org/archive/html/grub-devel/2015-12/msg00015.html