Given this situation, that's exactly what I'd be doing.
John's advice does appear to be true; you won't be penalised for duplicate content but your rankings won't be great either.
Theoretically, Google should have no issue determining the fact that site A was the original source of that content and so it should suffer no ranking change at all. Canonicalisation is the path I'd be taking to hedge bets there and mitigate risk as much as possible.
It's still not guaranteed to be safe (Google may choose to ignore canonicalisation) but it's about as close as you're going to get. Hopefully the client doesn't drag their feet and take 2 years to get that content production started 
