When I clone my repo to a new VirtualHost, I always have to run composer.phar update, which modifies composer.lock. Also, it usually gives me a message to update composer.phar. Should these files be added to .gitignore?
composer.lock should be ignored, it's generated/updated every time you run composer.
If you ignore composer.phar, you can't run composer after you cloned the repo, which you have to (if you're on 1.6) otherwise it won't work. So in that case you need to install composer manually on the new server somewhere.