Assume the following scenario:
Alice obtains a GPL-licensed code and make modifications to it. However, she does not release the modifications to public, but instead uploads the modified code to Google Drive under a secret link, and sends that link to Bob (or uploads it to a private repository and sends Bob access credentials). Moreover, Alice allows Bob to share the link itself to whomever under any conditions.
Bob sends the link to Charlie, additionally requiring that Charlie does not distribute the link, nor the software downloaded from that link, to anybody.
Is this a violation of GPL, and if yes, who does violate and why?
I think that Alice does not violate GPL because she does not place any restrictions on distibuting the code, and simply distributes it under GPL terms. Bob may be in violation, but... does he distribute the code at all?
GPL states:
To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
Simply forwarding a link to the software, even with additional restrictions, does not seem to fit under "propagation" (and thus "conveying"), because it can not make Bob liable for infringement. (At least, in many jurisdictions, see, e.g., https://law.stackexchange.com/questions/4360/is-it-infringement-to-give-a-link-to-a-copyrighted-file) Or can it?
Moreover, I would say that Bob can forward a link to Charlie, even if he does not have any license for the software behind the link. So GPL should not be applicable to Bob's action at all, because Bob does not any license at all. Is this wrong, and if yes, then how?