Only check for the package time if a package is actually installed from source, refs #2096

src/Composer/Package/Locker.php

@@ -280,7 +280,7 @@ class Locker
             // always move time to the end of the package definition
             $time = isset($spec['time']) ? $spec['time'] : null;
             unset($spec['time']);
-            if ($package->isDev()) {
+            if ($package->isDev() && $package->getInstallationSource() === 'source') {
                 // use the exact commit time of the current reference if it's a dev package
                 $time = $this->getPackageTime($package) ?: $time;
             }