A composite software stack is distributed as a virtual appliance. A new virtual appliance is published by obtaining a parent virtual appliance; configuring the new virtual appliance; obtaining file level differences between the parent virtual appliance and the new virtual appliance; and publishing the new virtual appliance as a patch comprising the file level differences relative to the parent virtual appliance. The file level differences comprise additions, deletions and/or modifications to the parent virtual appliance. An update to a given virtual appliance can be published as a fix pack, wherein the fix pack comprises file level differences relative to the given virtual appliance. An end user obtains a desired virtual appliance by selecting the desired virtual appliance; obtaining metadata for the desired virtual appliance comprising an identifier of a patch file and a parent virtual appliance; and applying the patch file to the parent virtual appliance to get a modified virtual appliance.