Which release channel is canonical?

[gspr]

I maintain the cdsapi package in Debian [1]. Until now, I've been importing tarballs from the PyPI page [2]. I would prefer basing the package on this git repository instead, but I notice that the 0.3.1 git tag and the cdsapi-0.3.1.tar.gz tarball from PyPI do not have identical content. Which release channel is considered canonical and official?

Thanks.

[1] https://tracker.debian.org/pkg/python-cdsapi

[2] https://pypi.org/project/cdsapi/