During my Ph.D. work at a university, I followed up on someone else's doctoral work (I am no longer associated with that university). This person provided me with the source code for his work. I subsequently discovered that this source code is a slightly modified copy of some publicly available sources, which have a GPL license. The modifications are mostly some instruction toggling/rebracketing and variable renaming. Just a few instructions contain slight modifications (that I personally do not find any more justifiable than the variable renaming). Moreover, in the versions that this person gave me, the authorship headers of the original authors are replaced by his own and the copyright mentions of the university in question are also added. The GPL license notice, which is present in the original sources, is removed from all but one package.
I had reported these observations to my supervisors (who also supervised the work of the person in question), but they sought to suppress the matter and warned me of legal actions if I reported this matter any further (hence I am not reporting it directly to the university, which by the way does not seem to have an ethics committee). I'll note that these observations in the source code are part of several issues that I observed in this person's work (that involves several publications and his doctoral dissertation; I'll probably ask for advice regarding that in separate questions).
Is it legally safe if I publicly share the source code provided by this person along with the links to the online available original sources? The code was transferred to me by this person through a sharing link that is no longer available. I can only prove that I reported my observations to my supervisors as well as to this person (he responded by reaffirming that the source code was developed at the university in question and refused any further communication). I'll note that an engineer at the university trans-coded some of the source code in question for use in a commercial product for which the university had a collaboration with a private firm.
I am also a co-author of this person in a couple of publications. This collaboration was supposed to be a sort of transition/continuation, at the beginning of my doctoral program and the end of his, of his reportedly high-functioning work. When I discovered several anomalies, I requested my supervisors to get these publications retracted. My detailed response is at the PubPeer page of one of these publications. In my response, I have also shared some of my email exchanges with my co-authors. These exchanges lend support for raising the issue about the source code, without actually sharing it.
I was quite shocked when this person suggested that he not only did not have to acknowledge the use of the existing ideas/solutions but also considered their mere mention to be optional (his exact words: "You do not have to acknowledge but you can cite them"). Concerns about the acknowledgment of the sources, the soundness of ideas, and various peculiarities in results are raised on the PubPeer pages of his several publications.
Considering my question about the legal aspect, the comments about this being a legal question are right. However, I would also like to know if publishing this source code would be objectively helpful (a part of it was given to me with the GPL notice intact). Some comments on the above-mentioned PubPeer pages compare long extracts and a large number of equations from the publications to point out something that can be noticed in a glance by comparing the source codes.
Thanks for the discussion in response to my query! Depending on the input in the comments, I might post this part as a separate question.