Thank you everyone for your responses. Since it turns out I don't greatly care about the non-latest package versions, I'll be weeding these out as I build the hash, resulting in a scan through the full data just one time, rather than for each lookup. I'll be using the application name as the key, and the latest version as the value, so I end up with with this:

%apps = (
  gcc => '3.3.1',
  gzip => '1.2.4a',
  make => '3.79.1',
);
[download]

Then I can check defined($apps{gcc}) to see if gcc is installed, and $apps{gcc} to get the latest version. Thanks saintmike for guiding me down that path.

As for determining which version is the latest in any given case, in the 150 applications in my full list, cmp works in almost every case. I handle the remaining 5 or 6 packages by exception, but I'll be looking into the Versions module that Cody Pendant suggested to try to reduce the number of exceptions. Thanks again!