1. Overview
Learning management system that an institution can host itself, with course backup files.
Category: Research & Education.
2. Version and scope assessed
Version assessed: Pinned evidence 46c042e7da65f8cb2ec7dc19f46566ce61a393e1.
3. Overall determination
Computing determination
4. Principle profile
| Order | Principle | Finding |
|---|---|---|
| I | Sovereignty | Not assessed |
| II | Longevity | Not assessed |
| III | Locality | ◐ Partially meets |
| IV | Transparency and Control | Not assessed |
5. Fundamental requirements
| Requirement | Status |
|---|---|
| E1 Independent access to essential information | ✓ Pass |
| E2 Practicable exit and migration | ? Not Verified |
| E3 Independent interpretation and recovery | ? Not Verified |
| E4 Continuing authority and custody over already-created work | ✓ Pass |
| E5 Governability of consequential actions | ? Not Verified |
6. Evidence and verification
- E1: Moodle documents course backup and restore packages and site backup procedures. (source), confidence medium
- E2: Course backups can be restored into Moodle, but migration to another learning platform and preservation of all user data were not tested. (source), confidence medium
- E3: The backup task conditionally generates users.xml when user inclusion or kept roles require it, and conditionally includes user files depending also on anonymization. It separately writes files.xml and moodle_backup.xml before packaging. A course backup's user/file coverage is therefore settings-dependent, not equivalent to a complete site backup. (source), confidence medium
- E4: Moodle can be self-hosted and its data, configuration, and files can be managed by the operator. (source), confidence medium
- E5: The restore precheck code treats a backup from a newer Moodle as a warning, not by itself a blocking error; an excessively old backup format is an error. Cross-site user restoration also branches on user-creation permission. This corrects an overbroad assumption that every downgrade attempt is automatically refused. (source), confidence medium
- sovereignty: A positive Sovereignty finding requires established E1, E2 and E4 in the declared scope. The existing access/exit/custody record for Moodle (self-hosted) does not establish all three minimums. The prior positive finding is withdrawn; recorded storage and portability strengths remain facts, not a verified failure. (source), confidence medium
- longevity: E3 is not established for Moodle (self-hosted)'s existing essential-record scope. The previous Longevity finding is replaced by Not assessed, not a verified failure or a positive placeholder. (source), confidence medium
- locality: Moodle can operate on infrastructure chosen and controlled by the institution. (source), confidence medium
- transparency: The positive control observations above do not yet establish whole-scope E5. The methodology requires that minimum before a positive Transparency and Control finding; the previous positive finding is therefore withdrawn to Not assessed, not changed to Does not meet. (source), confidence medium
- E3: Course backup source conditionally includes users/files and writes several manifests, so a course package is not automatically a full site archive. Complete student submissions, grades, plugin state, accounts and permissions have not been independently reconstructed and compared. (source), confidence medium
- E5: Restore prechecks distinguish warnings/errors and permission-dependent user creation. They do not establish full target-deletion, grading/workflow mutation, role authority and correction/recourse across the declared course/site configuration. (source), confidence medium
7. Migration and recovery
Native storage format: Relational database plus course backup archives (.mbz).
Synchronization or runtime model: Self-hosted server; course backups restore to another instance.
Example export or inspection command (not verified against any particular version or data set): tar -tzf course.mbz | head
8. Architectural strengths
Established strengths and their scope are recorded in the evidence and assessment findings on this page.
9. Architectural limitations
- Source/retained-input inspection only; no installation or application restore performed.
- Real course/site restore comparisons, student submissions/grade coverage, deleting-target recovery, plugin dependencies and version-specific migrations remain untested.
10. Assessment findings and remaining work
Evidence update: 23 October 2026
- Resolved: The backup task conditionally generates users.xml when user inclusion or kept roles require it, and conditionally includes user files depending also on anonymization. It separately writes files.xml and moodle_backup.xml before packaging. A course backup’s user/file coverage is therefore settings-dependent, not equivalent to a complete site backup. Source.
- Resolved: The restore precheck code treats a backup from a newer Moodle as a warning, not by itself a blocking error; an excessively old backup format is an error. Cross-site user restoration also branches on user-creation permission. This corrects an overbroad assumption that every downgrade attempt is automatically refused. Source.
- Open: Real course/site restore comparisons, student submissions/grade coverage, deleting-target recovery, plugin dependencies and version-specific migrations remain untested. E5 needs role- and target-aware restore/delete/grading authority, inspectable mutations and available correction for student/course records.
Assessment follow-up: These bounded findings are incorporated into the evidence above. Eligibility and principle ratings are deliberately unchanged; their reconciliation and any blank-status fixes are deferred to the next pass. Reproduction details and retained inputs are in evidence/third-pass/batch-10/.
Human-readable criteria: Can a user preserve records, structure, media, and provenance, restore them independently, and move to another tool without losing meaning?
Rating reconciliation: 24 October 2026
E3 and E5 remain Not Verified for the existing declared scope. Longevity and Transparency and Control are Not assessed pending their required minimums. Sovereignty is also Not assessed because the required access/exit/custody minimums are not all established. This is a targeted evidence decision, not a finding that the product fails. Existing E1, E4 and Locality findings were not re-certified.
Remaining: Real course/site restore comparisons, student submissions/grade coverage, deleting-target recovery, plugin dependencies and version-specific migrations remain untested. E5 needs role- and target-aware restore/delete/grading authority, inspectable mutations and available correction for student/course records.
Next without installing locally: Inspect synthetic course/site manifests and files with expected submissions, grades, roles and plugin dependencies; obtain same-version external restore/permission/deletion comparisons. Do not use real student data.
The individual decision and provenance are retained in evidence/rating-reconciliation/batch-10/. Overall: Insufficient evidence.
Contribute verification evidence for Moodle (self-hosted)
Have you tested clean-machine restoration, format migration, or failure rollback for Moodle (self-hosted)? We welcome reproducible laboratory logs, synthetic test fixtures, and independent assessments to resolve open findings.
Read the evaluation protocol · Submit verification records on GitHub
Individually reconciled in rating batch 10 on 24 October 2026. E3/E5 remain Not Verified for explicit missing coverage; dependent unsupported findings corrected. Previously resolved questions are retained, not counted again. E1/E4/Locality were not re-certified by this targeted review. The assessment procedure is described in the methodology.