You are right that there is a better way to build the command argument array. Your can assign the array as a list, the variable values don't need to be quoted, interpolating quotes are unneeded for constant values,and your trinary operator is a bit clumsy. I suggest this:

my $buildcmd    = "/path/to/foo/binary";   
my @buildcmd = ( '-p', $workpath,
                 '-P', $workpath,
                 '-H', $pl_url,
                 "--maxdepth=@{[$maxd < 3 ? $maxd : 2]}");
push @buildcmd, "--bpp=$bpp" if $bpp;
push @buildcmd, "--$compr-compression" if $compr;
push @buildcmd, ('-N', $title,
                 '-V3',
                 '-f', "$workpath/$md5file");
[download]

The trinary in $maxd is probably unnecessary if you have already checked that in validation. Having validation fail on missing required values can likely be done by checking one of existance, definedness or truth for required keys in the %template hash.

my @need = grep { $template{$_} } qw( url maxdepth filename);</p>
[download]

Adjust to need with extra keys, exists, defined, etc. Testing against values in a hash of regexes over the same keys would be an elegant way to get validation and untainting done at the same time.

After Compline,
Zaxo