Keep CycloneDX, remove SPDX

pom.xml

@@ -84,6 +84,7 @@ limitations under the License.
     <dependencyCheck.version>11.1.1</dependencyCheck.version>
     <dependencyCheck.skip>false</dependencyCheck.skip>
     <dependencyCheck.threshold>7</dependencyCheck.threshold>
+    <cyclonedx.skip>false</cyclonedx.skip>
   </properties>
   <dependencies>
     <dependency>
@@ -318,14 +319,17 @@ limitations under the License.
         </configuration>
       </plugin>
       <plugin>
-        <groupId>org.spdx</groupId>
-        <artifactId>spdx-maven-plugin</artifactId>
-        <version>0.7.4</version>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+        <version>2.9.1</version>
+        <configuration>
+	  <skip>${cyclonedx.skip}</skip>
+        </configuration>
         <executions>
           <execution>
-            <id>build-spdx</id>
+            <phase>package</phase>
             <goals>
-              <goal>createSPDX</goal>
+              <goal>makeAggregateBom</goal>
             </goals>
           </execution>
         </executions>