The GNU FAQ says the following, which should pretty much answer your question:
Can I make binaries available on a network server, but send sources
only to people who order them?
If you make object code available on a network server, you have to provide the Corresponding Source on a network server as well. The
easiest way to do this would be to publish them on the same server,
but if you'd like, you can alternatively provide instructions for
getting the source from another server, or even a version control
system. No matter what you do, the source should be just as easy to
access as the object code, though. This is all specified in section
6(d) of GPLv3.
The sources you provide must correspond exactly to the binaries. In particular, you must make sure they are for the same version of the
program—not an older version and not a newer version.
So, e.g. just put a link into an
About-dialog of your program which should point to a server under your control or a versioning system like git (and probably github).
Be careful about what the other answer suggests:
just give a contact email for the source and auto reply with a link where you got the library from originally if you didn't modify it or a link to a zip in a dropbox with the modifications.
This is basically the opposite from what the GNU-FAQ says. It seems like you are not allowed to only provide the source code on request (maybe if you only distribute your binaries on request but certainly not if you provide them on a webpage). Most likely you will never get in trouble if you do what ratchet freak suggests, but that doesn't mean that it is the right way.
A linked entry about version control systems the the FAQ-section cited above, says:
Users should be provided with clear and convenient instructions for how to get the source for the exact object code they downloaded—they may not necessarily want the latest development code, after all.
So make sure you comply with this by, for example, specifying the program's current version number in the
About-dialog and setting concurrent tags in the git repository.
And at the end the obligatory "I am not a lawyer" note ;)