From 129fd00583655b94bc53a2d2c32579d82f06ccef Mon Sep 17 00:00:00 2001
From: Emily Albini <emily@oxidecomputer.com>
Date: Wed, 25 Feb 2026 11:38:49 +0100
Subject: [PATCH] switch to permslip sign-platform-identity-csr

---
 dice-mfg/src/main.rs | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/dice-mfg/src/main.rs b/dice-mfg/src/main.rs
index 2fede46..a35bfaf 100644
--- a/dice-mfg/src/main.rs
+++ b/dice-mfg/src/main.rs
@@ -113,8 +113,8 @@ enum Command {
     },
     /// Turn a CSR into a cert. This is a thin wrapper around either the
     /// `openssl ca` command (whose behavior will depend on the openssl.cnf
-    /// provided by the caller), or `permslip sign` (whose behavior will be
-    /// governed by a previously set key context and batch of approvals).
+    /// provided by the caller), or `permslip sign-platform-identiyt-csr`
+    /// (whose behavior will be governed by a batch of approvals).
     SignCert {
         /// Path to input CSR file.
         #[clap(env)]
@@ -298,11 +298,10 @@ fn generate_cert(
         }
         CertificateAuthority::Permslip(cfg) => {
             let output = Process::new("permslip")
-                .arg("sign")
+                .arg("sign-platform-identity-csr")
                 .arg(cfg.key_name)
                 .arg(csr)
                 .arg("--sshauth")
-                .arg("--batch-approved")
                 .arg("--out")
                 .arg(cert)
                 .spawn()