Not for this PR, but I'm wondering if eof.download.main could use a tidy up? It's a bit unintuitive that it takes both CDSE and ASF credentials at this level, although that is explained with the comment. For readability, I would find it more intuitive if it attempted to download with CDSE credentials at the time where you check if source == "CDSE" -- however, I haven't looked at the function in detail, so there may be good reasons for having the downloader handle that logic.

Yeah happy to revisit later, it just means the eof.download.main function call will be written an extra time. It was a little cleaner before the try except for the .netrc had to be introduced. Think it could do with a restructure now.