D20546 + D20574 likely introduced an issue with reproducible builds. It was expected that guix would use it's own version of Corrosion, but as v0.5.1 was published with the wrong version number 0.5.0, CMake fell back to the tar.gz download from github. And DOWNLOAD_EXTRACT_TIMESTAMP TRUE causes the extracted files to be set to the time of extraction, adding a source of non-reproducibility.
Let's jsut always use the downloaded archive with its preserved timestamps, so we always get the same result.
Alternatively we could require 0.5.0 to match the wrong version number, but that would be confusing and require comments. And add a source of issues for local builds, in case the actual Corrosion 0.5.0 is installed.