Apache directory index listing can be made pretty quite easily by adding headers, footers, CSS styles and replacing file type images. What this doesn't have is directory trees and as discussed in this seems like a feature that is a must. To have trees we need to have some kind of server-side script, I'll check what is available and report here.

I'm not sure it's only repoman, as I also recall a few times seeing outdated info via the PHP interface ( which I verified by visiting plain.resources.ovirt.org ), so either it was a caching issue on the browser or a bug in the PHP, its another issue that justifies removing this app. ( along with the potential security implications )

So to summarize, I agree we should improve the default HTML page resources.ovirt.org shows, and possibly brand it with oVirt colors and logo,
and then remove the PHP app.

Ah,.. right so its ONLY a repoman issue.

It worked because repoman is parsing the HTML source and not the repo metadata AFAIK

It wasn't reposync who failed, it was repoman when trying to fetch: 'rec:http://resources.ovirt.org/pub/ovirt-4.1-pre/rpm/el7' :

2017-08-10 11:59:53,387::ERROR::repoman.common.parser::No artifacts found for source rec:http://resources.ovirt.org/pub/ovirt-4.1-pre/rpm/el7/,
from http://jenkins.ovirt.org/job/ovirt-system-tests_manual/933/artifact/exported-artifacts/lago_logs/lago.log,

while another attempt using plain.resources.ovirt.org worked.

Any self respecting project has a good looking page listing releases and downloadable packages. I don't think we should flush that baby with the bathwater. We can consider doing this differently by branding the index pages that Apache yields instead of using the PHP script we currently use.

I actually wonder why does reposync fail to work with resources.ovirt.org, the index display should not matter to it at all, since its only supposed to be downloading the repo metadata files. We need to check if the graphical UI blocks access to those, and see if we can make it not do that.

Also changign the title of the ticket because its misleading, "plain HTTP" sounde like its as opposed to "HTTPS". While what is meant here is using plain HTML INDEX pages as opposed to the AJAX UI.

I disagree, if there is no real use for the UI (php) part, let's just remove it, and have resources.ovirt.org point to plain.resources.ovirt.org.
Anyone who wants to use see the real packages in the repo, can use repoquery and not rely on the UI interface.

We've seen cases where OST can fail because of it ( when running the manual job ) and also a potential security risk like we've had a few years ago, with an exploit to the PHP file.

So confuse end users do avoid confusing developers at a rare use case? Not a smart trade off IMO. This should be CLOSED WONTFIX.