Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
•
Sicherheitslücken (CVE)USN-8821-1: OpenStack Swift vulnerability(24.09.2026 um 21:18 Uhr)
•
Sicherheitslücken (CVE)USN-8820-1: curl vulnerabilities(24.09.2026 um 22:13 Uhr)
•
Linux Tipps & HardeningDSA-6512-1 libreoffice - security update(24.09.2026 um 02:00 Uhr)
••••••••
Sicherheitslücken (CVE)USN-8821-1: OpenStack Swift vulnerability(24.09.2026 um 21:18 Uhr)
•
Sicherheitslücken (CVE)USN-8820-1: curl vulnerabilities(24.09.2026 um 22:13 Uhr)
•
Linux Tipps & HardeningDSA-6512-1 libreoffice - security update(24.09.2026 um 02:00 Uhr)
•••••••
Intelligence View
⚡ tsecurity.de Intelligence

Testing Kotlin Multiplatform: A Suite That Runs Mostly Without a Device

The fastest test suite is the one that doesn't need a device. That sounds like a testing tip, but it's really an architecture result: if your logic lives in a framework-free core behind interfaces, the vast majority of it is plain Kotlin…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

The fastest test suite is the one that doesn't need a device. That sounds like a testing tip, but it's really an architecture result: if your logic lives in a framework-free core behind interfaces, the vast majority of it is plain Kotlin you can test in commonTest — no emulator, no simulator, no flake. This post walks the full testing pyramid I run on KMP suites, from pure domain tests up through snapshots and performance.






Why the hexagonal core pays off in tests



CoreLib holds domain logic and port interfaces only — no Android, no platform SDKs. That single rule means a use case never touches a real network, GPS, or Bluetooth stack; it touches an interface. In tests you pass a fake. So the bulk of the suite is fast, deterministic, and lives in commonMain's sibling commonTest:




// commonTest — pure, no platform, runs on every target
class PlayabilityCalculatorTest {
@Test
fun penalizesHighWind() {
val ctx = scoringContext(windMph = 35, tempF = 68, rain = false)
val score = PlayabilityCalculator().calculateScore(ctx)
assertTrue(score.value < 50
}
}






kotlin.test gives you @Test/assert* that compile to JUnit on JVM/Android and XCTest on iOS — write once, run on all targets.






Faking platforms with expect/actual



When a test does need a platform seam, you don't mock the SDK — you depend on the port and substitute a fake. For the rare cases where a common test needs a platform primitive, expect/actual lets you provide a test implementation per target. The result: 90%+ of behavior is verified in commonTest, and platform code shrinks to thin, separately-tested adapters.






Testing the reactive layer with Turbine



KMP code is full of Flow/StateFlow. Asserting on emissions by hand is painful; Turbine makes it readable:




@Test
fun emitsConnectingThenConnected() = runTest {
bleClient.connectionState.test {
assertEquals(DISCONNECTED, awaitItem())
bleClient.connect("device-1")
assertEquals(CONNECTING, awaitItem())
assertEquals(CONNECTED, awaitItem())
cancelAndIgnoreRemainingEvents()
}
}






runTest + a test dispatcher make coroutine time deterministic, so these run instantly and don't flake.






Enforcing the architecture with ArchUnit



The reason the core stays testable is that nothing leaks platform dependencies into it — and that's itself a test. ArchUnit turns the architecture rules into assertions that fail the build when someone violates them:




@Test
fun domainHasNoPlatformDependencies() {
classes().that().resideInAPackage("..core.domain..")
.should().onlyDependOnClassesThat()
.resideOutsideOfPackages("android..", "platform..", "java.net..")
.check(importedClasses)
}






This is the highest-leverage test in the suite: it keeps every other test fast by guaranteeing the boundary never erodes. (In CI this runs in the cheap "gate before you build" step.)






Coverage with Kover, as a gate



Kover measures multiplatform coverage and can fail the build below a threshold — so coverage is enforced, not aspirational:




kover {
reports {
verify { rule { minBound(80) } } // build fails under 80%
}
}






A badge on each library's README turns that into a credibility signal for anyone browsing the repo.






UI: snapshot testing with Paparazzi



Compose UI gets verified without a device using Paparazzi, which renders composables to images and diffs them against goldens:




@Test fun radarView_dark() {
paparazzi.snapshot { ViewPointTheme(dark = true) { RadarView(rssi = mapOf("A" to -60)) } }
}






Catches visual regressions (spacing, color, layout) in CI, no emulator needed. For interaction logic, Compose UI tests / Robolectric cover the Android side; iOS UI is exercised in simulator tests.






Performance as a test: Macrobenchmark



Speed regressions are bugs too. Macrobenchmark measures startup time and jank/frame timing on a real device build, and Baseline Profiles bake in the wins:




@Test fun startup() = benchmarkRule.measureRepeated(
packageName = "com.example.app",
metrics = listOf(StartupTimingMetric()),
iterations = 5,
startupMode = StartupMode.COLD
) { pressHome(); startActivityAndWait() }






Track the numbers over time and a PR that regresses startup gets caught before it ships.






The pyramid, summarized






























































Layer Tool Where Speed
Domain logic kotlin.test, MockK commonTest ⚡ instant
Reactive flows Turbine commonTest ⚡ instant
Architecture rules ArchUnit JVM ⚡ instant
Coverage gate Kover all fast
UI snapshots Paparazzi JVM render fast
Android UI/integration Robolectric / Compose UI test Android medium
iOS XCTest (simulator) macOS runner medium
Performance Macrobenchmark device slow (nightly)


The shape is deliberate: nearly everything that can fail is caught in the fast, deviceless tiers, so CI stays cheap and developers get answers in seconds. The slow tiers (device perf, simulator) run where they belong — not on every keystroke.






Takeaway



A KMP testing suite isn't a pile of tools; it's a consequence of architecture. Keep the core framework-free, depend on ports, and the majority of your behavior becomes pure commonTest that runs on every target without a device. Then layer ArchUnit to protect the boundary, Kover to enforce coverage, Turbine for flows, Paparazzi for pixels, and Macrobenchmark for speed — and let CI run the cheap tiers on every push and the expensive ones on a schedule.

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Testing Kotlin Multiplatform: A Suite That Runs Mostly Without a Device
id: 26398e23-202d-442b-ba87-d6e62a7c69aa
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Testing Kotlin Multiplatform: " ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Testing Kotlin Multiplatform A Suite Tha")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Testing Kotlin Multiplatform A Suite Tha*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Testing Kotlin Multiplatform A Suite Tha"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Testing Kotlin Multiplatform: A Suite Th.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Testing Kotlin Multiplatform: A Suite That Runs Mostly Without a Device

Thematisch verwandte Begriffe: Testing, Kotlin, Multiplatform, Suite · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-81473 | Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an …
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle